Judgment;Summary — ECLI:EU:C:2020:901
Date: 2020-11-11
Language of the case: Romanian
Court formation: Second Chamber
Subject matter: Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Romania

Translation C-61/19 -1 
Case C-61/19 
Request for a preliminary ruling 
Date lodged: 
29 January 2019 
Referring court: 
Tribunalul București (Romania) 
Date of the decision to refer: 
14 November 2018 
Applicant: 
Orange România S.A. 
Defendant: 
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu 
Caracter Personal (ANSPDCP) 
  
... [file number] 
… 
TRIBUNALUL BUCUREȘTI 
(Regional Court, Bucharest) 
… 
ORDER 
Public hearing of 14 November 2018 
… [composition of the court] 
There is pending before this court an administrative action brought by the 
applicant ORANGE ROMÂNIA S.A. against the defendant AUTORITATEA 
NAȚIONALĂ DE SUPRAVEGHERE A PRELUCRĂRII DATELOR CU 
CARACTER PERSONAL (the National Authority for the Supervision of 
EN 
REQUEST FOR A PRELIMINARY RULING OF 14.11.2018 — CASE C-61/19 
 
2  
Personal Data Processing), in which the applicant seeks the annulment of 
Administrative Notice No 10380/28.03.2018. 
... [national procedure] 
… [OR. 2] … [decision on certain procedural pleas] 
In connection with the request for a referral to the Court of Justice of the 
European Union, the court sets out the following considerations: 
I. SUCCINCT PRESENTATION OF THE FACTS 
1. Orange is [a] provider of mobile telecommunication services on the Romanian 
market. 
2. Orange provides: 
(a) services under the ‘PrePay’ system, in which case the recipient of the 
services pays in advance the price of the services to be provided, and 
(b) services pursuant to the conclusion of a service contract, in which case the 
price of the services provided by the company is paid by the recipient of the 
services after they have been provided on the basis of the invoices issued [by the 
company]. 
3. By contrast with those who receive services offered by Orange under the ‘PrePay’ 
system, persons who conclude service contracts have the opportunity to acquire 
communications terminal equipment on preferential terms, being offered 
substantial price reductions, instalment facilities and so on. 
4. Because the company’s activities involve the processing of personal data, Orange 
is registered in Registrul de Evidență a Prelucrărilor de Date cu Caracter Personal 
(Personal Data Processing Records Register), kept by the Autoritatea Națională de 
Supraveghere a Prelucrării Datelor cu Caracter Personal (the National Authority 
for the Supervision of Personal Data Processing, ‘the ANSPDCP’), which is the 
supervisory authority in the field. 
5. Pursuant to its supervisory role as supervisory authority, on 26 March 2018, the 
ANSPDCP initiated an investigation at business premises of the company … in 
Bucharest (‘the business premises’). The purpose of the investigation was to 
verify Orange’s compliance with the provisions of Legea nr 677/2001, [pentru 
protecţia persoanelor cu privire la prelucrarea datelor cu caracter personal și libera 
circulaţie a acestor date (Law No 677/2001 on the protection of persons with 
regard to the processing of personal data and on the free movement of such data)] 
and Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și 
protecția vieții private în sectorul comunicațiilor electronice, cu modificările și 
completările ulterioare (Law No 506/2004 on the processing of personal data and 
ORANGE ROMANIA 
 
3 
the protection of privacy in the electronic communications sector, as subsequently 
amended and supplemented). 
6. The investigation was suspended on 26 March 2018 because the company was 
unable to provide all the documents and information requested by the 
investigation team relating to the archiving procedure, the archiving policy and the 
contract with the company entrusted with the archiving of contracts, or the details 
regarding the procedure for the conclusion of contracts. Those circumstances were 
recorded in the report of the investigation/Sanction No 9972/26.03.2018, drawn 
up by the investigation team. [OR. 3] 
7. The investigation was resumed on 28 March 2018 at the registered office of 
Orange and was completed on that date, the members of the investigation team 
consequently drafting the report of the investigation/Sanction 
No 10380/28.03.2018 (‘the investigation report’). 
8. In the investigation report, inter alia, pursuant to Article 32 of Law No 677/2001, 
read in conjunction with Article 8 of the same law, an administrative penalty was 
imposed on Orange on the ground that copies of the identity documents of its 
customers had been taken and kept without their express consent. 
9. The supervisory bodies concluded that Orange had committed the acts mentioned 
in the preceding paragraph on the basis of the following findings: 
(a) in the period between 1 March 2018 and 26 March 2018, approximately 40 
paper-based contracts with individual customers had been concluded at the 
business premises, and annexed to those contracts were copies of the customers’ 
identity documents; 
(b) the content of the abovementioned contracts included, inter alia, a statement 
of the fact that the customer had been informed of and had consented to the 
keeping [by Orange] of copies of his documents containing personal data for the 
purposes of identification and that that information has been collected and that the 
customer has consented by ticking a box in the written documentation evidencing 
the contract (see below). 
The following matters are mentioned in the contract: 
– A statement by the customer that: 
(i) he has been informed, prior to concluding the contract, of the chosen tariff 
plan, the applicable tariffs, the minimum duration of the contract, the 
conditions for terminating [the contract] and the terms for obtaining and 
using the services, including the area covered by the services, in accordance 
with Article 11 of ANCOM [the National Authority for Management and 
Regulation in Communications] Decision No 158/2015 and with 
O.U.G. Decision [No] 34/2014 (Legislative Decree No 34/2104), and of his 
REQUEST FOR A PRELIMINARY RULING OF 14.11.2018 — CASE C-61/19 
 
4  
right unilaterally to terminate the contract, which may be exercised pursuant 
to Article 1.17 of the General Terms and Conditions; 
(ii) Orange România has provided the customer with all the necessary 
information to enable him to express his unvitiated, express, free and 
specific consent to the conclusion and express assumption of the contract, 
including all the contractual documentation, the General Terms and 
Conditions and the Brochure of Tariffs and Services; 
(iii) he has been informed of and has consented to the following: 
– the processing of personal data for the purposes referred to in 
Article 1.15 of the General Terms and Conditions; 
– the keeping [by Orange] of copies of documents containing personal 
data for the purposes of identification; 
– the agreement for the processing of personal data (contact number and 
email) for direct marketing purposes; 
– the agreement for the processing of personal data (contact number and 
email) for market research purposes; 
– I have read and expressly agree to the keeping of documents 
containing personal data relating to state of health; 
– the data referred to in Article 1.15(10) of the General Terms and 
Conditions are not included in subscriber information and subscriber 
directory services. 
(c) the customers, upon concluding the contracts, had given their consent, 
including in relation to the collection and keeping by Orange of copies of their 
documents containing personal data for the purposes of identification, without 
being given the opportunity to express their preference on the matter. 
II. PROVISIONS OF NATIONAL LAW AND OF EU LAW RELIED 
ON IN THE PRESENT CASE 
2.1 Provisions of national law [OR. 4] 
1. Article 8 of Law No 677/2001: 
‘1. The processing of an individual’s personal identification number and of 
other personal data having a generally applicable identification function may be 
carried out only if: 
(a) the data subject has expressly given his or her consent, or 
ORANGE ROMANIA 
 
5 
(b) the processing is expressly provided for by a provision of law. 
2. The supervisory authority may also establish other cases in which the 
processing of the data referred to in paragraph 1 may be carried out, provided that 
adequate safeguards are in place to protect the rights of data subjects.’ 
2. Article 12 of Law No 677/2001: 
‘1. Where personal data are obtained directly from the data subject, the 
controller shall provide at least the following information to the data subject, 
unless the data subject already possesses that information: 
(a) the identity of the controller and of his representative, if any; 
(b) the purpose of the data processing; 
(c) additional information, such as: the recipients or the categories of recipients 
of the data; whether the provision of all the data requested is mandatory and 
the consequences of refusal to provide the data; the existence of the rights 
laid down by this law for the data subject, in particular the right to access the 
data, to change them and to contest them, as well as the conditions under 
which those rights may be exercised; 
(d) any other information which must be provided pursuant to a provision of the 
supervisory authority, having regard to the specific nature of the processing. 
2. Where the data are not obtained directly from the data subject, the controller 
shall, at the time of data collection or, if it is intended to disclose the data to third 
parties, at the latest by the time of the first disclosure, provide at least the 
following information to the data subject, unless the data subject already possesses 
that information: 
(a) the identity of the controller and of his representative, if any; 
(b) the purpose of the data processing; 
(c) additional information, such as: the categories of data concerned, the 
recipients or the categories of recipients of the data; the existence of the 
rights laid down by this law for the data subject, in particular the right to 
access the data, to change them and to contest them, as well as the 
conditions under which those rights may be exercised; 
(d) any other information which must be provided pursuant to a provision of the 
supervisory authority, having regard to the specific nature of the processing. 
3. The provisions of paragraph 2 shall not apply where the processing of the 
data is solely for journalistic, literary or artistic purposes, where their application 
would give rise to information on the sources of information. 
REQUEST FOR A PRELIMINARY RULING OF 14.11.2018 — CASE C-61/19 
 
6  
4. The provisions of paragraph 2 shall not apply where the processing of the 
data is for statistical purposes, for historical or scientific research or in any other 
situation in which the provision of such information proves impossible or would 
entail an effort disproportionate to the legitimate interest that could be harmed, or 
in situations in which the recording or the disclosure of the data is expressly 
provided for by law.’ 
3. Article 13 of Law No 677/2001: 
‘1. Every data subject shall have the right to obtain from the controller, on 
request and free of charge for one request per year, confirmation as to whether or 
not data concerning him are processed by the controller. The controller shall, if he 
processes personal data [OR. 5] concerning the applicant, communicate to the 
applicant, together with the confirmation, at least the following: 
(a) information on the purposes of the processing, the categories of data 
concerned and the recipients or categories of recipients to whom the data are 
disclosed; 
(b) communication to him in an intelligible form of the data undergoing 
processing and of any available information as to the source of the data; 
(c) information on the operating principles of the mechanism by which any 
automatic processing of the data relating to that person is carried out; 
(d) information on the existence of the right to change the data and to contest it, 
as well as the conditions under which those rights may be exercised; 
(e) information on the possibility of consulting the register of records of 
personal data processing referred to in Article 24, of lodging a complaint 
with the supervisory authority and of taking legal action in court to 
challenge decisions of the controller in accordance with the provisions of 
this law. 
2. The data subject may request from the controller the information referred to 
in paragraph 1 by means of a written, dated and signed application. In the 
application, the applicant may indicate whether he wishes the information to be 
communicated to him at a specific address, which may also be an email address, 
or through a postal service which ensures that the information is delivered to him 
personally. 
3. The operator shall communicate the information requested within 15 days of 
the date of receipt of the request, in accordance with the option, if any, expressed 
by the applicant pursuant to paragraph 2. 
4. In the case of personal data relating to state of health, the application 
referred to in paragraph 2 may be made by the data subject either directly or 
through a medical establishment, which shall indicate in the application the person 
ORANGE ROMANIA 
 
7 
in whose name the application is made. At the request of the controller or the data 
subject, the communication referred to in paragraph 3 may be made through a 
medical establishment designated by the data subject. 
5. Where personal data relating to state of health are processed for scientific 
research purposes, if there is at least no apparent risk of prejudice to the rights of 
the data subject and provided that the data are not used to take a decision or to 
adopt a measure in relation to a particular person, the communication referred to 
in paragraph 3 may be made within a period longer than that provided for in that 
paragraph, in so far as that communication might affect the good conduct or the 
results of the research, but by no later than the time when research is completed. 
In such a case, the data subject must have expressly and unequivocally given his 
consent to the processing of the data for the purposes of scientific research and to 
the possible postponement of the communication referred to in paragraph 3 for 
this reason. 
6. The provisions of paragraph 2 shall not apply when the data processing is 
solely for journalistic, literary or artistic purposes, where their application would 
give rise to information on the sources of information.’ 
4. Article 14 of Law No 677/2001: 
‘1. Every data subject shall have the right to obtain from the controller, on 
request and free of charge: 
(a) where appropriate, the correction, the updating, the blocking or the deletion 
of data the processing of which does not comply with this law, in particular 
incomplete or inaccurate data; 
(b) where appropriate, the transformation into anonymous data of data the 
processing of which does not comply with this law; 
(c) the notification of third parties to whom the data has been disclosed of any 
operation under (a) or (b), if such notification does not prove impossible or 
does not entail an effort disproportionate to the legitimate interest that might 
be harmed. [OR. 6] 
2. In order to exercise the rights provided for in paragraph 1, the data subject 
shall submit to the controller a written, dated and signed application. In the 
application, the applicant may indicate whether he wishes the information to be 
communicated to him at a specific address, which may also be an email address, 
or through a postal service which ensures that the information is delivered to him 
personally. 
3. The controller shall communicate the measures taken on the basis of 
paragraph 1 and, where appropriate, the name of the third party to whom the 
personal data relating to the data subject have been disclosed within 15 days of the 
REQUEST FOR A PRELIMINARY RULING OF 14.11.2018 — CASE C-61/19 
 
8  
date of receipt of the application, in accordance with the option, if any, expressed 
by the applicant pursuant to paragraph 2.’ 
5. Article 15 of Law No 677/2001: 
‘1. The data subject shall have the right to oppose at any time, for well-founded 
and legitimate reasons relating to his particular situation, the processing of data 
relating to him, except where there are legal provisions to the contrary. In the 
event of justified opposition, the processing may no longer cover the data in 
question. 
2. The data subject shall have the right to oppose at any time, free of charge 
and without any justification, the processing of data relating to him for direct 
marketing purposes, on behalf of the controller or a third party, or disclosed to 
third parties for such purposes. 
3. In order to exercise the rights provided for in paragraphs 1 and 2, the data 
subject shall submit to the controller a written, dated and signed application. In the 
application, the applicant may indicate whether he wishes the information to be 
communicated to him at a specific address, which may also be an email address, 
or through a postal service which ensures that the information is delivered to him 
personally. 
4. The controller shall communicate to the data subject the measures taken on 
the basis of paragraph 1 or paragraph 2 and, where appropriate, the name of the 
third party to whom the personal data relating to the data subject have been 
disclosed within 15 days of the date of receipt of the application, in accordance 
with the option, if any, expressed by the applicant pursuant to paragraph 3.’ 
6. Article 32 of Law No 677/2001: 
‘The processing of personal data by a controller, or by a person mandated by him, 
in breach of the provisions of Articles 4 to 10 or without due regard to the rights 
provided for in Articles 12 to 15 or Article 17, shall constitute an administrative 
office unless it is carried out in such circumstances as to constitute a criminal 
offense, and shall be penalised by a fine of between 10 000 000 old Lei [RON 
1 000] and 250 000 000 old Lei [RON 25 000].’ 
2.2 Provisions of European Union law 
Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council 
of 24 October 1995 on the protection of individuals with regard to the processing 
of personal data and on the free movement of such data (‘The Directive’): ‘For the 
purposes of this Directive … “the data subject’s consent” shall mean any freely 
given specific and informed indication of his wishes by which the data subject 
signifies his agreement to personal data relating to him being processed’. 
ORANGE ROMANIA 
 
9 
III. GROUNDS 
1. The Romanian legislature had not adopted the definition ‘the data subject’s 
consent’, as it is set out in Article 2(h) of the Directive. 
2. In that context, Orange has been penalised on the ground that it collected and 
stored copies of its clients’ identity documents, inter alia, in the absence of their 
express consent. The ANSPDCP has submitted that the company has failed to 
prove [OR. 7] express consent on the part of its customers as defined in 
Article 2(h) of the Directive, which requires, inter alia, that they be informed, that 
is to say, that the indication of their wishes in favour of the processing in question 
was informed. 
3. However, the company has submitted that, since the definition in Article 2(h) of 
the Directive was not taken up in Law No 677/2001 when the Directive was 
transposed, that provision cannot be relied on by the ANSPDCP against it, given 
that the Court of Justice made clear, in its judgment in Case 152/84 [Marshall v 
Southampton and South-West Hampshire Area Health Authority (Teaching)] that, 
where there has been a failure to transpose a directive, the provisions of that 
directive cannot be relied on against individuals. Orange is therefore required 
solely to demonstrate that its contractual partners in the 40 contracts mentioned in 
the investigation report gave their specific and informed consent to the carrying 
out of the data processing in question, regard being had to the meaning of that 
expression in civil law. 
4. In the event that the [referring] court considers that the provisions of Article 2(h) 
of the Directive can be relied on against the company and that, as a result, Orange 
is required to demonstrate the specific and informed nature of the consent of its 
contracting partners in the 40 contracts mentioned in the investigation report to the 
data processing in question, then the court considers that the present case cannot 
be resolved without first establishing the meaning of the expression ‘specific and 
informed indication of his wishes’ used in Article 2(h) of the Directive. 
5. In circumstances such as those of the present case, in which: 
(i) there are both telecommunication services contracts in which the customer 
‘ticks’ [the appropriate box for] his freely expressed option for the retention 
of a copy of his identity document containing his CNP [personal 
identification number], 
(ii) and examples to the contrary, where customers have refused to express such 
agreement (and in situations of this kind not only is this option ‘ticked’ in 
the contract but, in addition, specific forms are signed to this effect), it is 
particularly important that the Court of Justice interpret the expression 
‘specific and informed consent’ and explain the criteria by reference to 
which it can be established whether or not consent is specific and informed, 
and whether the inclusion of wording of the kind in the contract and 
REQUEST FOR A PRELIMINARY RULING OF 14.11.2018 — CASE C-61/19 
 
10  
signature, that is to say, agreement, by signature, to all the contractual 
clauses, can prove specific and informed consent. 
6. Moreover, it is necessary to take into consideration the specific circumstances of 
the case, in which, regardless of the terms included in the general regulations 
(Orange’s General Terms and Conditions), the company has not refused to sign 
subscription contracts even if customers have refused to consent to the retention of 
a copy of their identity card. As is apparent from Orange’s internal sales 
procedure, in such cases, the company has made the necessary comments about 
the customer’s opposition to the retention of a copy of his identity document and 
has filled in a specific form to that effect and then concluded the contract. 
IV. THE QUESTIONS FOR A PRELIMINARY RULING 
1. For the purposes of Article 2(h) of Directive 95/46/EC of the European 
Parliament and of the Council on the protection of individuals with regard to the 
processing of personal data and on the free movement of such data, what 
conditions must be fulfilled in order for an indication of wishes to be regarded as 
specific and informed? 
2. For the purposes of Article 2(h) of Directive 95/46/EC of the European 
Parliament and of the Council on the protection of individuals with regard to the 
processing of personal data [OR. 8] and on the free movement of such data, what 
conditions must be fulfilled in order for an indication of wishes to be regarded as 
freely given? 
... [provisions on the staying of the national proceedings] 
ORDERS 
... [decision on procedural pleas] 
Grants the request made by the applicant ORANGE ROMANIA S.A. to make a 
referral to the Court of Justice of the European Union with a request for a 
preliminary ruling on the interpretation of Article 2(h) of Directive 95/46/EC of 
the European Parliament and of the Council … 
... [provisions on the staying of the national proceedings] 
... [provisions of national procedural law] 
... [signature and date] 
... [an explanation of the reasons for the request for a preliminary ruling identical 
to that set out in Part III of the order]