Judgment;Abstract — ECLI:EU:C:2025:871
Date: 2025-11-13
Language of the case: Romanian
Court formation: First Chamber
Procedure: Reference for a preliminary ruling;Reference for a preliminary ruling - inadmissible
Origin: Romania

Summary  C-654/23 – 1 
Case C-654/23 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
2 November 2023 
Referring court: 
Curtea de Apel București (Romania) 
Date of the decision to refer: 
20 March 2023 
Applicant and appellant: 
Inteligo Media SA 
Defendant and respondent: 
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu 
Caracter Personal (ANSPDCP) 
  
Subject matter of the main proceedings 
Appeals brought against a civil judgment partially upholding the appellant’s 
complaint against a report of an administrative offence drawn up by the 
respondent, on the basis of which the appellant received an administrative fine for 
breaching certain provisions of Regulation (EU) 2016/679 on the protection of 
natural persons with regard to the processing of personal data and on the free 
movement of such data. 
Subject matter and legal basis of the request 
On the basis of Article 267 TFEU and Article 19(3)(b) of the Treaty on European 
Union, the interpretation is sought of Article 13(1) and (2) and Article 15(2) of 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 
2002 concerning the processing of personal data and the protection of privacy in 
the electronic communications sector, Article 2(f) of Directive 2000/31/EC of the 
European Parliament and of the Council of 8 June 2000 on certain legal aspects of 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-654/23 
 
2  
information society services, in particular electronic commerce, in the Internal 
Market and Article 6(1)(a) to (f), Article 83(2) and Article 95 of Regulation (EU) 
2016/679. 
Questions referred for a preliminary ruling 
(1) In a case in which a publisher of online news publications providing 
information to the general public, which does not specialise in the field, regarding 
the legislative amendments issued each day in Romania, obtains the email address 
of a user when the latter creates a free user account entitling him or her: (i) to 
access, free of charge, an additional number of articles from the publication in 
question; (ii) to receive, via email, a daily newsletter containing a summary of the 
new legislation discussed in articles within the publication and hyperlinks to those 
articles; and (iii) to access, for a fee, additional and/or more extensive articles and 
analyses from the publication compared with those in the free daily newsletter: 
(a) is that email address obtained by the publisher of the online news 
publication ‘in the context of the sale of a product or a service’ within the 
meaning of Article 13(2) of Directive 2002/58/EC of the European Parliament and 
of the Council of 12 July 2002 concerning the processing of personal data and the 
protection of privacy in the electronic communications sector (Directive on 
privacy and electronic communications) (‘Directive 2002/58/EC’)? 
(b) is the transmission by the news publisher of a newsletter such as that 
described in the abovementioned point (ii) carried out ‘for direct marketing of its 
own similar products or services’ within the meaning of Article 13(2) of Directive 
2002/58/EC? 
(2) If the answers to Question 1(a) and (b) are in the affirmative, which of the 
conditions laid down in Article 6(1)(a) to (f) of Regulation (EU) 2016/679 must 
be interpreted as applying when the publisher uses the user’s email address for the 
purpose of sending a daily newsletter such as that described in Question 1(ii), in 
accordance with the requirements of Article 13(2) of Directive 2002/58/EC? 
(3) Must Article 13(1) and (2) of Directive 2002/58/EC be interpreted as 
precluding national legislation which uses the concept of ‘commercial 
communication’ laid down in Article 2(f) of Directive 2000/31/EC of the 
European Parliament and of the Council of 8 June 2000 on certain legal aspects of 
information society services, in particular electronic commerce, in the Internal 
Market (‘Directive on electronic commerce’) (‘Directive 2000/31/EC’) instead of 
the concept of ‘direct marketing’ laid down in Directive 2002/58/EC? If not, does 
a newsletter such as that described in Question 1(ii) constitute a ‘commercial 
communication’ within the meaning of Article 2(f) of Directive 2000/31/EC? 
(4) If the answers to Question 1(a) and (b) are in the negative: 
INTELIGO MEDIA 
 
3 
(a) does the transmission via email of a daily newsletter such as that described 
in Question 1(ii) constitute ‘use […] of electronic mail for the purposes of direct 
marketing’ within the meaning of Article 13(1) of Directive 2002/58/EC? 
(b) must Article 95 of Regulation (EU) 2016/679, in conjunction with 
Article 15(2) of Directive 2002/58/EC, be interpreted as meaning that failure to 
comply with the conditions for obtaining valid consent from the user pursuant to 
Article 13(1) of Directive 2002/58/EC will be penalised in accordance with 
Article 83 of Regulation (EU) 2016/679 or in accordance with the provisions of 
national law contained in the act transposing Directive 2002/58/EC, which 
contains specific penalties? 
(5) Must Article 83(2) of Regulation (EU) 2016/679 be interpreted as meaning 
that a supervisory authority which decides whether to impose an administrative 
fine and decides on the amount of the administrative fine in each individual case is 
obliged to analyse and explain in the administrative act imposing the fine the 
effect of each of the criteria laid down in points (a) to (k) on the decision to 
impose a fine and, respectively, on the decision regarding the amount of the fine 
imposed? 
Provisions of European Union law relied on 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 
2002 concerning the processing of personal data and the protection of privacy in 
the electronic communications sector (Directive on privacy and electronic 
communications) and subsequent amendments and additions (‘Directive 
2002/58/EC’), Recitals 10, 17 and 41, Article 1(1) and (2), Article 2(d) and (f), 
Article 13(1) to (3) (paragraph 1 lays down the obligation to obtain subscribers’ 
consent to the use of electronic mail for marketing purposes and paragraph 2 sets 
out the conditions under which a natural or legal person who has obtained from its 
customers their electronic contact details for electronic mail, in the context of the 
sale of a product or service, may use those electronic contact details for the direct 
marketing of its own similar products or services) and Article 15(2) 
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 
2000 on certain legal aspects of information society services, in particular 
electronic commerce, in the Internal Market (‘Directive on electronic commerce’) 
(‘Directive 2000/31/EC’), Recital 18 and Article 2(f) (which defines the concept 
of ‘commercial communication’) 
Directive (EU) 2015/1535 of the European Parliament and of the Council of 
9 September 2015 laying down a procedure for the provision of information in the 
field of technical regulations and of rules on Information Society services 
(‘Directive (EU) 2015/1535’), Article 1(1)(b) and (c) 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-654/23 
 
4  
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (‘the GDPR’), Recitals 47, 70 and 
173, Article 5(1)(a), Article 6, Article 7(1), (2) and (4), Article 83, Article 94(1) 
and (2) and Article 95 
Case-law of the Court of Justice of the European Union (‘the Court’), in particular 
judgment of 12 February 2008, Kempter (C-2/06, EU:C:2008:78, paragraph 41); 
judgment of 18 July 2013, Consiglio nazionale dei geologi (C-136/12, 
EU:C:2013:489, paragraph 28); judgment of 6 October 2021, Consorzio Italian 
Management and Catania Multiservizi (C-561/19, EU:C:2021:799, paragraph 66); 
judgment of 6 October 1982, CILFIT and Others (283/81, EU:C:1982:335, 
paragraphs 16 and 17); and judgment of 25 November 2021, StWL Städtische 
Werke Lauf a.d. Pegnitz (C-102/20, EU:C:2021:954) 
Provisions of national law relied on 
Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția 
vieții private în sectorul comunicaților electronice (Law No 506/2004 on the 
processing of personal data and the protection of privacy in the electronic 
communications sector): 
 - Article 1(2), which provides that that law ‘shall apply to the processing of 
personal data in connection with the provision of publicly available electronic 
communications services on public electronic communications networks […]’ and 
paragraph (3); 
- Article 2(1) and (2); 
- Article 12(1), (2) and (4), according to which ‘it is forbidden to send 
commercial communications […] by electronic mail or any other method using 
publicly available electronic communications services, except where the 
subscriber or user concerned has given express prior consent to receiving such 
communications’ (paragraph 1); ‘if a natural or legal person directly obtains the 
email address of a customer, at the time of the sale by that person of a product or 
service, […] the natural or legal person concerned may use that address to send 
commercial communications relating to similar products or services marketed by 
that person, provided that customers are clearly and expressly offered the 
possibility of objecting to such use easily and free of charge, both when the 
electronic mail address is obtained and when each message is sent, where the 
customer has not initially objected’ (paragraph 2); ‘the provisions of paragraphs 1 
and 3 shall also apply correspondingly to subscribers [who are] legal persons’ 
(paragraph 4); 
- Article 13(1), (2) and (5), which provides for administrative penalties in the 
event of the infringement of the aforementioned Article 12; 
- Article 15, which provides that that law transposes Directive 2002/58/EC. 
INTELIGO MEDIA 
 
5 
Legea nr. 365/2002 privind comerțul electronic (Law No 365/2002 on electronic 
commerce):  
- Article 1(8), which defines the concept of ‘commercial communication’ as 
‘any form of communication designed to promote, directly or indirectly, the 
goods, services, image […] of a seller or a member of a regulated profession 
[…]’; 
- Article 32, which provides that Law No 365/2002 transposes Directive 
2000/31/EC. 
Succinct presentation of the facts and procedure in the main proceedings 
1 Inteligo Media SA (‘Inteligo Media’) is the publisher of the online news 
publication avocatnet.ro, which informs the general public about the legislative 
amendments issued each day in Romania. 
2 Users of the online publication can view, free of charge and without further 
action, a maximum number of articles set by the publication (6 articles at the 
material time). 
3 In 2018, Inteligo Media introduced a paid subscription system called ‘Serviciu 
Premium’ (‘the Premium Service’) for users who, upon reaching the 6-article 
viewing limit, wished to access additional articles from the online publication. 
4 The Premium Service subscription required, firstly, that the user create a free user 
account on the platform. The creation of an account required the user’s acceptance 
of the contractual terms and conditions for the provision of the Premium Service 
by Inteligo Media. 
5 By subscribing to the Premium Service, the user obtained the right to free access 
to an additional number of views of the publication’s content and to receive a 
daily newsletter, via email, called ‘Personal Update’ (unless he or she had opted 
not to benefit from that service), and, for a fee and as an option, access to all of 
the publication’s articles and, via email, to a series of daily newsletters called 
‘Sinteze Informative’ (‘Informative Summaries’). 
6 The Personal Update daily email newsletter contained, in essence, details of the 
legislative news from the previous day, with a hyperlink to the relevant articles 
that appeared in the publication. 
7 In order to allow users, when their email address is obtained, to opt out of 
receiving the Personal Update daily newsletter via email, the words ‘Nu vreau să 
primesc Personal Update, informarea transmisă zilnic gratuit pe e-mail de 
avocatnet.ro’ (‘I do not want to receive Personal Update, the free daily email 
newsletter from avocatnet.ro’) appeared as a tickbox in the account creation form 
and needed to be ticked by the user in question. Similarly, when receiving any 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-654/23 
 
6  
newsletter by email, users who no longer wished to receive the Personal Update 
could select the Dezabonare (‘Unsubscribe’) option. 
8 For users who created their account on the platform for a purpose other than 
subscribing to the free Premium Service and accessing additional content, the field 
relating to the Personal Update newsletter was programmed not to appear and the 
Personal Update daily newsletter was not sent to those categories of user. 
9 On 26 September 2019, the Autoritatea Națională de Supraveghere a Prelucrării 
Datelor cu Caracter Personal (National Supervisory Authority for the Processing 
of Personal Data) (‘the Authority’) drew up a report on its findings and on the 
administrative penalty by which it imposed on the company Inteligo Media an 
administrative fine of RON 42 714 (the equivalent of EUR 9 000); in the 
aforementioned report, it was found that, from July 2018, Inteligo Media 
processed the personal data (email addresses, passwords, usernames) of 4 357 
users (natural persons) on the grounds of a legal basis which was not appropriate 
for the purpose of the processing in question, namely the daily transmission via 
email of the Personal Update newsletter, without proving that it had obtained the 
express consent of the users concerned to the processing of their personal data for 
that given purpose. The Authority concluded that Inteligo Media had infringed 
Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 of the GDPR. 
10 The appellant Inteligo Media lodged a complaint with the Tribunalul București – 
Secția a II-a de Contencios Administrativ și Fiscal (Regional Court, Bucharest – 
Second Division for Administrative and Tax Matters) requesting, principally, the 
annulment of the aforementioned report and its exemption from liability for the 
administrative offence. 
11 The judgment delivered on 5 June 2020 by the Regional Court, Bucharest, which 
dismissed the appellant’s complaint, was overturned on appeal by the Curtea de 
Apel București (Court of Appeal, Bucharest) and the case was referred back for a 
new judgment. 
12 When it re-examined the case, through the civil judgment of 15 December 2021, 
the Regional Court, Bucharest – Second Division for Administrative and Tax 
Matters partially upheld the complaint and reduced the fine that was imposed; 
however, it upheld the finding of an offence for the infringement of the 
requirement to obtain express consent in relation to the processing of data through 
the Personal Update, in accordance with the GDPR. 
13 Both the appellant and the respondent have appealed against that civil judgment, 
with those appeals pending before the referring court, the Court of Appeal, 
Bucharest. 
INTELIGO MEDIA 
 
7 
The essential arguments of the parties in the main proceedings 
14 The aspect at issue between the parties is the lawful basis applicable to the 
processing of the personal data of users subscribed to the free Premium Service 
offered by the appellant when the Personal Update newsletter was sent to those 
users each day via email. 
15 The appellant submits that it treated the Personal Update newsletter as a 
commercial communication relating to similar goods or services to those which it 
offers, which means that Article 12(2) of Law No 506/2004, which transposes 
Article 13(2) of Directive 2002/58/EC into national law, is applicable to the 
processing of personal data in the present case. Thus, the appellant offered users 
(i) the option to object to receiving the Personal Update newsletter (by ticking the 
‘I do not want to receive Personal Update, the free daily email newsletter from 
avocatnet.ro’ box, which appears when creating the account), and, if they did not 
object initially, (ii) the option, at any time, to object and to opt out of receiving the 
newsletter by clicking the instant Unsubscribe button available in every Personal 
Update email newsletter. 
16 In addition, the appellant also based the data processing in question on 
Article 6(1)(f) [of the GDPR], according to which processing is lawful where it is 
necessary for the purposes of the legitimate interests pursued by the controller. 
17 Consequently, the appellant claims that it was not required to seek the express 
consent of users subscribed to the free Premium Service to sending the Personal 
Update newsletter. 
18 Moreover, it should be borne in mind that Article 95 of the GDPR does not 
impose additional obligations on natural or legal persons in relation to processing 
in connection with the provision of publicly available electronic communications 
services where Directive 2002/58/EC applies to them. 
19 The Authority submits that Directive 2002/58/EC does not apply in this case, and 
that the lawful basis for the processing of personal data is the provisions of the 
GDPR. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
20 The referring court considers that the need for the present request for a 
preliminary ruling is determined by the fact that the relevant provisions of EU law 
relied on in the present case have not been interpreted by the Court and that their 
interpretation is not free of reasonable doubt for the referring court, as the court of 
last instance (see paragraphs 16 and 17 of the judgment in CILFIT and Others, 
and paragraph 66 of the judgment in Consorzio Italian Management and Catania 
Multiservizi). 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-654/23 
 
8  
21 This concerns the provisions of Article 13(1) and (2) and Article 15 of Directive 
2002/58/EC and Article 83(2) and Article 95 of the GDPR, the correct 
interpretation of which determines the lawful basis of the processing in the present 
case and, by implication, whether the contested report should be upheld or 
annulled.  
22 As regards the first three questions referred for a preliminary ruling, the referring 
court states that, in order to resolve the national dispute, it is necessary to clarify 
the conditions under which a user’s email address is deemed to have been 
obtained ‘in the context of the sale of a product or a service’, as provided for in 
Article 13(2) of Directive 2002/58/EC, taking into account the appellant’s 
arguments based on the structure of the services which it offers and the way in 
which users have access to them. 
23 Furthermore, in the absence of a definition in EU legislation, it is necessary to 
clarify the concept of ‘direct marketing’ contained in Article 13 of Directive 
2002/58/EC in order to determine whether the way in which the appellant used its 
subscribers’ email addresses corresponds to use for the purposes of direct 
marketing and whether that concept is equivalent to the concept of ‘commercial 
communication’ used by the national legislature in the context of Article 12 of 
Law No 506/2004, which transposes Article 13 of Directive 2002/58/EC into 
national law. 
24 The Court’s interpretation of the concept of ‘direct marketing’ in the judgment in 
StWL Städtische Werke Lauf a.d. Pegnitz does not provide sufficient clarification 
to resolve the main dispute. 
25 The fourth question referred for a preliminary ruling is raised in the event that the 
Court considers that obtaining the email address of a subscriber to the free 
Premium Service does not take place ‘in the context of the sale of a product or a 
service’ within the meaning of Article 13(2) of Directive 2002/58/EC. In that case, 
the referring court seeks to ascertain whether the transmission via email of the 
Personal Update newsletter leads to the applicability of Article 13(1) of Directive 
2002/58/EC, in the sense that it is necessary to obtain the subscriber’s prior 
consent to ‘the use of […] electronic mail for the purposes of direct marketing’. In 
the event that the latter provision is applicable in the present case, it is necessary 
to determine which regulatory act governs penalties for the failure to comply with 
the conditions for obtaining valid consent from the subscriber, as laid down in 
Article 13(1) of Directive 2002/58/EC. 
26 The fifth question referred for a preliminary ruling is necessary since it is not clear 
from the wording of Article 83(2) of the GDPR which specific obligations are 
incumbent on the authority issuing the penalty when applying that article; that 
aspect is relevant as regards the method of determining the penalty for the 
administrative offence which is the subject of the main dispute.