Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH.
Date: 2019-10-01
41


However, the referring court stated that, in view of the entry into force, on 25 May 2018, of Regulation 2016/679, to which part of the first question refers, it was likely that that regulation would need to be taken into account when disposing of the case in the main proceedings. In addition, as the German Government stated at the hearing before the Court, it is not inconceivable that, in so far as the proceedings brought by the Federation seek an order that Planet49 refrain from future action, Regulation 2016/679 would be applicable ratione temporis to the case in the main proceedings according to the national case-law regarding the relevant legal position on injunctions, which is for the referring court to ascertain (see, as regards an action for a declaratory judgment, judgment of 16 January 2019, Deutsche Post, C‑496/17, EU:C:2019:26, paragraph 38).
43


The questions referred must therefore be answered having regard to both Directive 95/46 and Regulation 2016/679.
47


In that regard, it should be noted that, the need for a uniform application of EU law and the principle of equality require that the wording of a provision of EU law which makes no express reference to the law of the Member States for the purpose of determining its meaning and scope must normally be given an autonomous and uniform interpretation throughout the European Union (judgments of 26 March 2019, SM (Child placed under Algerian kafala), C‑129/18, EU:C:2019:248, paragraph 50, and of 11 April 2019, Tarola, C‑483/17, EU:C:2019:309, paragraph 36).
48


In addition, according to settled case-law of the Court, the interpretation of a provision of EU law requires that account be taken not only of its wording and the objectives it pursues, but also of its legislative context and the provisions of EU law as a whole. The origins of a provision of EU law may also provide information relevant to its interpretation (judgment of 10 December 2018, Wightman and Others, C‑621/18, EU:C:2018:999, paragraph 47 and the case-law cited).
52


Thus, as the Advocate General stated in point 60 of his Opinion, the requirement of an ‘indication’ of the data subject’s wishes clearly points to active, rather than passive, behaviour. However, consent given in the form of a preselected tick in a checkbox does not imply active behaviour on the part of a website user.
53


That interpretation is borne out by Article 7 of Directive 95/46, which sets out an exhaustive list of cases in which the processing of personal data can be regarded as lawful (see, to that effect, judgments of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 30, and of 19 October 2016, Breyer, C‑582/14, EU:C:2016:779, paragraph 57).
54


In particular, Article 7(a) of Directive 95/46 provides that the data subject’s consent may make such processing lawful provided that the data subject has given his or her consent ‘unambiguously’. Only active behaviour on the part of the data subject with a view to giving his or her consent may fulfil that requirement.
55


In that regard, it would appear impossible in practice to ascertain objectively whether a website user had actually given his or her consent to the processing of his or her personal data by not deselecting a pre-ticked checkbox nor, in any event, whether that consent had been informed. It is not inconceivable that a user would not have read the information accompanying the preselected checkbox, or even would not have noticed that checkbox, before continuing with his or her activity on the website visited.
57


As regards the foregoing, the consent referred to in Article 2(f) and Article 5(3) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46, is therefore not validly constituted if the storage of information, or access to information already stored in an website user’s terminal equipment, is permitted by way of a checkbox pre-ticked by the service provider which the user must deselect to refuse his or her consent.
58


It should be added that the indication of the data subject’s wishes referred to in Article 2(h) of Directive 95/46 must, inter alia, be ‘specific’ in the sense that it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subject’s wishes for other purposes.
61


As the Advocate General stated, in essence, in point 70 of his Opinion, the wording of Article 4(11) of Regulation 2016/679, which defines the ‘data subject’s consent’ for the purposes of that regulation and, in particular, of Article 6(1)(a) thereof, to which Question 1(c) refers, appears even more stringent than that of Article 2(h) of Directive 95/46 in that it requires a ‘freely given, specific, informed and unambiguous’ indication of the data subject’s wishes in the form of a statement or of ‘clear affirmative action’ signifying agreement to the processing of the personal data relating to him or her.
62


Active consent is thus now expressly laid down in Regulation 2016/679. It should be noted in that regard that, according to recital 32 thereof, giving consent could include ticking a box when visiting an internet website. On the other hand, that recital expressly precludes ‘silence, pre-ticked boxes or inactivity’ from constituting consent.
63


It follows that the consent referred to in Article 2(f) and in Article 5(3) of Directive 2002/58, read in conjunction with Article 4(11) and Article 6(1)(a) of Regulation 2016/679, is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his or her consent.
64


Lastly, it should be noted that the referring court has not referred to the Court the question whether it is compatible with the requirement that consent be ‘freely given’, within the meaning of Article 2(h) of Directive 95/46 and of Article 4(11) and Article 7(4) of Regulation 2016/679, for a user’s consent to the processing of his personal data for advertising purposes to be a prerequisite to that user’s participation in a promotional lottery, as appears to be the case in the main proceedings, according to the order for reference, at least as far as concerns the first checkbox. In those circumstances, it is not appropriate for the Court to consider that question.
74


As the Advocate General stated in point 115 of his Opinion, clear and comprehensive information implies that a user is in a position to be able to determine easily the consequences of any consent he or she might give and ensure that the consent given is well informed. It must be clearly comprehensible and sufficiently detailed so as to enable the user to comprehend the functioning of the cookies employed.