Judgment;Abstract — ECLI:EU:C:2019:801
Date: 2019-10-01
Language of the case: German
Court formation: Grand Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Telecommunications;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

summary, my proposed answer to Question 1(a) and c) is that there is no valid consent within the meaning of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46, in a situation such as that of the main proceedings where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent and where consent is given not separately but at the same time as confirmation in the participation in an online lottery. The same goes for the interpretation of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 4, point 11, of Regulation 2016/679. (b) The first checkbox 94. Although the questions of the referring court refer to the second checkbox only, I should like to make two specific remarks with respect to the first checkbox, which may assist the referring court in its final decision. 95. To recall, the first checkbox does not deal with cookies but only with the processing of personal data. Here, a user agrees not to having information stored on his equipment but (merely) to being contacted by a list of firms by post, telephone or email. 96. First, the criteria on active and separate consent and full information obviously also apply with respect to the first checkbox. Active consent does not appear to pose a problem, since the checkbox is not pre-ticked. By contrast, I have some doubts about separate consent. On the basis of the analysis above, (49) with respect to the facts to the present case, it would be better if, figuratively speaking, there were a separate button to be clicked, (50) rather than merely a box to be ticked, in order to consent to the processing of personal data. 97. Secondly, as regards the first checkbox on the contact by sponsors and cooperation partners, regard should be had to Article 7(4) of Regulation 2016/679. Pursuant to this provision, when assessing whether consent is freely given, utmost account is to be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Article 7(4) of Regulation 2016/679, therefore, now codifies a ‘prohibition on bundling’. (51) 98. As transpires from the terms ‘utmost account shall be taken of’, the prohibition on bundling is not absolute in nature. (52) 99. Here, it will be for the competent court to assess whether the consent to the processing of personal data is necessary for the participation in the lottery. In this respect it should be kept in mind that the underlying purpose in the participation in the lottery is the ‘selling’ of personal data (i.e. agreeing to be contacted by so-called ‘sponsors’ for promotional offers). In other words, it is the providing of personal data which constitutes the main obligation of the user in order to participate in the lottery. In such a situation it appears to me that the processing of this personal data is necessary for the participation in the lottery. (53) 3. On personal data (Question 1(b)) 100. I should now like to examine whether, for the purposes of the application of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46, it makes a difference whether the information stored or accessed constitutes personal data. 101. This question is best understood against the background of German law transposing Article 5(3) of Directive 2002/58. (54) In fact, German law establishes a difference between the collection and use of personal data and other data. 102. Pursuant to Article 12(1) of the TMG, a service provider may collect and use personal data only if, among other things, the user has consented to it. 103. By contrast, according to Article 15(3) of the TMG, a service provider may create user profiles through pseudonyms, inter alia, for the purposes of advertising and market research, provided the user does not object to this. Ergo, in so far as no personal data are involved, the requirement is less strict under German law: not consent, but merely non-objection. 104. Personal data is legally defined in Article 4, point 1, of Regulation 2016/679 as ‘any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’. 105. I think it is beyond doubt that, as far as the case at issue is concerned, the ‘information’ referred to in Article 5(3) of Directive 2002/58 constitutes ‘personal data’. This too appears to be the view of the referring court, which explicitly states in its order for reference that the accessing of data from the cookies used by the defendant is subject to the requirement for consent under Article 12(1) of the TMG because the data in question here are personal data. (55) Moreover, it does not appear to be disputed between the parties in the main proceedings that we are dealing here with personal data. 106. One may therefore wonder about the relevance of this question for the case at issue and whether the question is not hypothetical. (56) 107. Be that as it may, I think the answer to this question is pretty straightforward: it makes no difference whether the information stored or accessed constitutes personal data. Article 5(3) of Directive 2002/58 refers to the ‘storing of information, or the gaining of access to information already stored’. (57) It is clear that any such information has a privacy aspect to it, regardless of whether it constitutes ‘personal data’ within the meaning of Article 4, point 1, of Regulation 2016/679 or not. As the Commission rightly stresses, Article 5(3) of Directive 2002/58 aims to protect the user from interference with his or her private sphere, regardless of whether that interference involves personal data or other data. 108. Such an understanding of Article 5(3) of Directive 2002/58 is, moreover corroborated by recitals 24 (58) and 25 (59) of that directive as well as Opinions of the ‘Article 29’ Working Party. Indeed, according to this Working Party, ‘Article 5(3) applies to “information” (stored and/or accessed). It does not qualify such information. It is not a prerequisite for the application of this provision that this information is personal data within the meaning of Directive 95/46’. (60) 109. As a consequence, it does appear as if Article 15(3) of the TMG does not fully transpose the requirements of Article 5(3) of Directive 2002/58 into German law. (61) 110. I therefore propose to reply to Question 1(b) that for the purposes of the application of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46 it makes no difference whether the information stored or accessed constitutes personal data. C. Question 2 111. By the second question, the referring court would like to know what information the service provider has to give within the scope of the requirement to provide clear and comprehensive information to the user in accordance with Article 5(3) of Directive 2002/58 and whether this includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies. 1. On clear and comprehensive information 112. Articles 10 and 11 of Directive 95/46 (and Articles 13 and 14 of Regulation 2016/679) set out an obligation to provide information to data subjects. The obligation to inform is linked to consent in that there must always be information before there can be consent. 113. Given the conceptual proximity of an internet user (and provider) to that of a consumer (and trader), (62) one can resort at this stage to the concept of the average European consumer who is reasonably well informed and reasonably observant and circumspect (63) and who is able to take the decision to make an informed commitment. (64) 114. However, due to the technical complexity of cookies, the asymmetrical information between provider and user and, more generally, the relative lack of knowledge of any average internet user, the average internet user cannot be expected to have a high level of knowledge of the operation of cookies. 115. Thus, clear and comprehensive information implies that a user is in a position to be able to easily determine the consequences of any consent he might give. To that end he must be able to assess the effects of his actions. The information given must be clearly comprehensible and not be subject to ambiguity or interpretation. It must be sufficiently detailed so as to enable the user to comprehend the functioning of the cookies actually resorted to. 116. This includes, as the referring court rightly suggests, both the duration of the operation of the cookies and the question of whether third parties are given access to the cookies. 2. Information on the duration of the operation of the cookies 117. By virtue of recitals 23 and 26 of Directive 2002/58, the duration of the operation of cookies is an element of the requirement for informed consent, meaning that service providers should ‘always keep subscribers informed of the types of data they are processing and the purposes and duration for which it is done’. Even if the cookie is essential, the question of how intrusive it is must be examined against the surrounding circumstances for consent purposes. In addition to asking what data each cookie holds and whether it is linked to any other information held about the user, service providers must consider the lifespan of the cookie and whether this lifespan is appropriate in light of the cookie’s purpose. 118. The duration of the operation of cookies relates to the explicit informed consent requirements regarding the quality and accessibility of information to users. This information is vital to enable individuals to make informed decisions prior to the processing. (65) As submitted by the Portuguese and Italian Governments, since data collected by cookies must be eliminated once it is no longer necessary to achieve the original purpose, it follows that the time period for storage of data collected must be clearly communicated to the user. 3. Information on third-party access 119. Here, Planet49 contends that if third parties gain access to a cookie, users must also be informed of this. However, if, as in the case at issue, only a provider who wishes to set the cookie has access to the cookie, it is sufficient to draw attention to this fact. The fact that other third parties have no access does not have to be pointed out separately. Such an obligation would not be compatible with the legislative intention that the data protection texts should remain user-friendly and concise. 120. I cannot subscribe to such an interpretation. Rather, for information to be clear and comprehensive, a user should be explicitly informed whether third parties have access to the cookies set or not. And if third parties have access, their identity must be disclosed. As the Bundesverband rightly stresses, this is indispensable in order to ensure that informed consent is given. 4. Result 121. I therefore propose to reply to the second question that the clear and comprehensive information a service provider has to give to a user, under Article 5(3) of Directive 2002/58, includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies or not. V. Conclusion 122. In the light of the foregoing considerations, I propose that the Court answer the questions referred by the Bundesgerichtshof (Federal Court of Justice, Germany) as follows: (1) There is no valid consent within the meaning of Articles 5(3) and 2(f) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), read in conjunction with Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data in a situation such as that of the main proceedings where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent and where consent is given not separately but at the same time as confirmation in the participation in an online lottery. (2) The same goes for the interpretation of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 4, point 11, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation). (3) For the purposes of the application of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46, it makes no difference whether the information stored or accessed constitutes personal data. (4) The clear and comprehensive information a service provider has to give to a user, under Article 5(3) of Directive 2002/58, includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies or not. 1 Original language: English. 2 Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). 3 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) (OJ 2016 L 119, p. 1). 4 Often termed the ‘E-Privacy Directive’. 5 Directive of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), as amended by Directive 2009/136/EC of the European Parliament and of the Council, of 25 November 2009 (OJ 2009 L 337, p. 11). 6 OJ 2002 L 108, p. 33. 7 Often termed the ‘cookie Directive’. 8 Directive of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58 and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws (OJ L 2009 L 337, p. 11). The normative content of Directive 2009/136 is therefore now contained in the latter directives as well as the mentioned Regulation, as amended (and, as regards the present case, in Article 5(3) of Directive 2002/58), which is the reason why in the present case, only a recital of Directive 2009/136 is cited. 9 I am well aware that, strictly speaking, one should be referring to ‘paragraphs’ (§) and not articles. Indeed, in Germany the latter are rarely resorted to and if so then only in very fundamental texts, such as the Basic Law. For ease of reference, however, I shall be referring to ‘articles’ throughout. 10 It should be pointed out that this is the previous version of the BDSG of 20 December 1990, as amended, and not the current version of 30 June 2017. 11 An idea of what the actual website looked like can be obtained here: https://web.archive.org/web/20130902100750/http:/www.dein-macbook.de:80/. 12 And other clauses not relevant to the case at issue. 13 ‘Berufung’. 14 ‘Revision’. 15 See also Opinion of Advocate General Bot in Wirtschaftsakademie Schleswig-HolsteinWirtschaftsakademie Schleswig-Holstein (C‑210/16, EU:C:2017:796, point 5). 16 See Lynskey, O., ‘Track[ing] changes: an examination of EU Regulation of online behavioural advertising through a data protection lens’, European Law Review, Sweet & Maxwell, 2011, pp. 874-886, at pp. 875-876. 17 See Lynskey, O., ibid., at p. 878. 18 See, in general, Clifford, D., ‘EU Data Protection Law and Targeted Advertising: Consent and the Cookie Monster – Tracking the crumbs of online user behaviour’, Journal of Intellectual Property, Information Technology and Electronic Commerce Law, 2014, pp. 195-196. 19 See http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm. 20 See Clifford, D., ibid., pp. 195-196. 21 See http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm 22 See http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm 23 See, for example, Opinion 04/2012 on Cookie Consent Exemption adopted by the ‘Article 29’ Working Party on 7 June 2012 (00879/12/EN, WP 194, p. 12). 24 To complete the picture, one might add that Directive 2002/58 had also been amended by Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58 (OJ 2006 L 105, p. 54). However, firstly, as transpires from Article 11 of Directive 2006/24, that amendment was minor and only concerned one article of Directive 2002/58 and, secondly and more importantly, Directive 2006/24 has in the meantime been declared invalid; see judgment of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 71). 25 Pursuant to Article 99(2) of Regulation 2016/679. 26 See Article 94(1) of Regulation 2016/679. 27 In German: ‘Unterlassungsanspruch’. 28 See Bundesgerichtshof, 23 February 2016, XI ZR 101/15, point II.1., Neue Juristische Wochenschrift (NJW), 2016, p. 1881: Insofar as the plaintiff’s application for injunctive relief is directed towards the future, claims for injunctive relief the legal basis of which has changed in the course of the legal proceedings are to be examined by the appellate court under consideration of the current legal situation, even if the legal amendment only entered into force after the conclusion of the oral hearing of the second instance or in the course of the appeal proceedings. See also Bundesgerichtshof, 13 July 2004, KZR 10/03, point I., Gewerblicher Rechtsschutz und Urheberrecht (GRUR), 2004, p. 62. 29 In relation to the applicability of Directive 95/46 and Regulation 2016/679 in the context of a Feststellungsklage under German procedural law, see judgment of 16 January 2019, Deutsche Post (C‑496/17, EU:C:2019:26, paragraph 39), and Opinion of Advocate General Campos Sánchez-Bordona in Deutsche Post (C‑496/17, EU:C:2018:838, point 32): ‘It is for the national court to interpret its national procedural law, on which the Court of Justice will not give a ruling. Consequently, if it is of the view that the domestic rules require the dispute to be resolved, ratione temporis, in accordance with Regulation 2016/679 rather than Directive 95/46, the Court of Justice must provide it with an interpretation of the former rather than the latter.’ 30 See Article 94(2) of Regulation 2016/679. 31 See, in general, recital 2. 32 The requirement for consent does not prevent the storage or access pursuant to the second sentence of Article 5(3) of Directive 2002/58 if the sole purpose is the carrying out of the transmission of a communication over an electronic communications network, or if storage or access is strictly necessary in order to provide the user with an information society service explicitly requested by him. In the present case, the storage or accessing of the information is not technically necessary within the meaning of the second sentence of Article 5(3) of Directive 2002/58, but rather is used for advertising purposes; therefore the exception to the requirement for consent does not apply. 33 See also Bond, R., ‘The EU E-Privacy Directive and Consent to Cookies’, The Business Lawyer, Vol. 68, No. 1, American Bar Association, November 2012, p. 215. 34 Instead of employing the pair of the terms ‘active’ and ‘passive’, one could also refer to the terms ‘explicit’ and ‘implicit’. 35 Strictly speaking, the requirement of separate consent already embodies the requirement for active consent. Because only if the consent criterion applies separately, can it not be ‘slipped-in’ by way of pre-selected settings. 36 This is not to say that the participation in a lottery cannot be made contingent upon consent. However, that consent must be separate and the user must be duly informed. I will come back to this point below. 37 And because I have already referred to recitals of Directives 2002/58 and 2009/136 above. 38 Judgments of 19 November 1998, Nilsson and Others (C‑162/97, EU:C:1998:554, paragraph 54); of 24 November 2005, Deutsches Milch-Kontor (C‑136/04, EU:C:2005:716, paragraph 32); and Opinion of Advocate General Ruiz-Jarabo Colomer in TeliaSonera Finland (C‑192/08, EU:C:2009:309, paragraphs 87 to 89). 39 See also my Opinion in Joined Cases X and VisserX and Visser (C‑360/15 and C‑31/16, EU:C:2017:397, point 132). 40 See second sentence of recital 17 of Directive 2002/58. 41 This is an advisory body set up pursuant to Article 29 of Directive 95/46. With the entry into force of Regulation 2016/679, the ‘Article 29’ Working Party was replaced by the European Data Protection Board (see Articles 68 and 94(2) of Regulation 2016/679). 42 See Opinion 2/2010 on online behavioural advertising, adopted by the ‘Article 29’ Working Party, on 22 June 2010 (00909/10/EN, WP 171, p. 16, point 4.1.3.). 43 Opinion 15/2011 on the definition of consent adopted by the ‘Article 29’ Working Party on 13 July 2011 (01197/11/EN, WP 187, p. 12). 44 Opinion 15/2011 on the definition of consent adopted by the ‘Article 29’ Working Party on 13 July 2011 (01197/11/EN, WP 187, p. 12). 45 Opinion 15/2011 on the definition of consent adopted by the ‘Article 29’ Working Party on 13 July 2011 (01197/11/EN, WP 187, p. 12). 46 This point, which already results from the order for reference, was explicitly confirmed by the Bundesverband during the hearing, pursuant to a question from the Court. 47 That is to say, the Bundesverband, the German, Italian and Portuguese Governments as well as the Commission. 48 See Article 7(4) of Regulation 2016/679. 49 See, in particular, point 66 of this Opinion. 50 A button such as the participation button. 51 In German terminology: ‘Kopplungsverbot’, see, among many, Ingold, A., in G. Sydow (ed.), Europäische Datenschutzgrundverordnung, Handkommentar, Nomos, Baden-Baden, 2017, Artikel 7, point 30. 52 See Heckmann, D., Paschke, A., in E. Ehmann, M. Selmayr (ed.), DS-GVO (Datenschutz-Grundverordnung), Kommentar, C.H. Beck, Munich, 2017, Artikel 7, point 53. 53 See in this sense also Buchner, J., Kühling, B., in J. Buchner, B. Kühling (eds), Datenschutz-Grundverordnung/BDSG, Kommentar, 2nd ed. 2018, C.H. Beck, Munich, Artikel 7 DS-GVO, point 48. 54 As amended by Directive 2009/136. 55 See point 24 of the order for reference. 56 Indeed, during the hearing the representative of the Bundesverband pointed out that a clarification of the Court with respect to Question 1(b) would be most helpful given a dispute in German legal doctrine on the question whether Article 15(3) of the TMG is in conformity with EU law or not. 57 My emphasis. 58 See Legal framework, above. 59 Ibid. 60 See Opinion 2/2010 on online behavioural advertising, adopted by the ‘Article 29’ Working Party on 22 June 2010 (00909/10/EN, WP 171, p. 9, point 3.2.1). In a similar vein, it is stated in Opinion 2/2013 on apps on smart devices, adopted by the ‘Article 29’ Working Party, on 27 February 2013 (00461/13/EN, WP 202, p. 7, point 3.1), that ‘the consent requirement of Article 5(3) applies to any information, without regard to the nature of the data being stored or accessed. The scope is not limited to personal data; information can be any type of data stored on the device’. 61 To be precise: the requirements of Directive 2009/136 amending, inter alia, Directive 2002/58. 62 On the terminology in the area of consumer protection, see Article 2 of Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights, amending Council Directive 93/13/EEC and Directive 1999/44/EC of the European Parliament and of the Council and repealing Council Directive 85/577/EEC and Directive 97/7/EC of the European Parliament and of the Council (OJ 2011 L 304, p. 64). 63 This being the classical terminology employed by the Court to describe the average European consumer. See, by way of example, judgments of 7 August 2018, Verbraucherzentrale BerlinVerbraucherzentrale Berlin (C‑485/17, EU:C:2018:642, paragraph 44); of 7 June 2018, Scotch Whisky Association (C‑44/17, EU:C:2018:415, paragraph 47); and of 16 July 1998, Gut Springenheide and TuskyGut Springenheide and TuskyGut Springenheide and TuskyGut Springenheide and Tusky (C‑210/96, EU:C:1998:369, paragraph 31). 64 See Opinion of Advocate General Saugmandsgaard Øe in slewo (C‑681/17, EU:C:2018:1041, point 55). 65 Opinion 15/2011 on the definition of consent, adopted by the ‘Article 29’ Working Party on 13 July 2011 (01197/11/EN, WP 187, p. 37).