Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).
Date: 2020-11-11
31


That being so, it is also apparent from the file before the Court that, by its decision, the ANSPDCP not only imposed a fine on Orange România, but also ordered it to destroy the copies of the identity documents at issue, and that the main proceedings also concern that latter order. As nothing in that file shows that that order was complied with before 25 May 2018, it is not inconceivable that, in the present case, Regulation 2016/679 is applicable ratione temporis to that order (see, to that effect, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraph 41).
32


In those circumstances, in order to enable the Court to provide useful answers to the questions submitted by the referring court, those questions must be answered on the basis of both Directive 95/46 and Regulation 2016/679 (see, by analogy, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraph 43).
34


In that regard, it should be borne in mind that Article 7 of Directive 95/46 and Article 6 of Regulation 2016/679 set out an exhaustive list of the cases in which the processing of personal data can be regarded as being lawful (see, regarding Article 7 of Directive 95/46, judgments of 19 October 2016, Breyer, C‑582/14, EU:C:2016:779, paragraph 57 and the case-law cited, and of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraph 53). In particular, Article 7(a) of that directive and Article 6(1)(a) of that regulation provide that the data subject’s consent may make such processing lawful.
35


As regards the requirements to which such consent is subject, Article 7(a) of Directive 95/46 provides that the data subject must have ‘unambiguously given his consent’, while Article 2(h) of that directive defines the term ‘consent’ as meaning ‘any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’. To the extent that those provisions set out that the data subject is to give an ‘indication of his wishes’ in order to give ‘unambiguously’ his consent, only active behaviour by that person with a view to giving his or her consent may be relevant (see, to that effect, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraphs 52 and 54).
36


That same requirement also operates in the context of Regulation 2016/679. Indeed, the wording of Article 4(11) of that regulation, which defines the ‘consent of the data subject’ for the purposes, inter alia, of Article 6(1)(a) of that regulation, appears even more stringent than Article 2(h) of Directive 95/46, in that it requires a ‘freely given, specific, informed and unambiguous’ indication of the data subject’s wishes in the form of a statement or by ‘a clear affirmative action’ signifying agreement to the processing of personal data relating to him or her. Accordingly, active consent is now expressly laid down in Regulation 2016/679 (see, to that effect, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraphs 61 to 63).
37


In that regard, while recital 32 of that regulation states that consent could be given, inter alia, by ticking a box when visiting an internet website, on the contrary, it expressly excludes the possibility that ‘silence, pre-ticked boxes or inactivity’ constitute consent. As the Court has held, in such a situation, it would appear impossible in practice to ascertain objectively whether a website user had actually given his or her consent to the processing of his or her personal data by not deselecting a checkbox pre-ticked beforehand nor, in any event, whether that consent had been informed. It is not inconceivable that a user would not have read the information accompanying the preselected checkbox, or even would not have noticed that checkbox, before continuing with his or her activity on the website visited (see, to that effect, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraphs 55 and 57).
38


Furthermore, Article 2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679 require a ‘specific’ indication of the data subject’s wishes in the sense that it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subject’s wishes for other purposes (see, regarding Article 2(h) of Directive 95/46, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraph 58).
40


As regards the requirement arising from Article 2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679 that consent must be ‘informed’, that requirement implies, in accordance with Article 10 of that directive, read in the light of recital 38 thereof, and with Article 13 of that regulation, read in the light of recital 42 thereof, that the controller is to provide the data subject with information relating to all the circumstances surrounding the data processing, in an intelligible and easily accessible form, using clear and plain language, allowing the data subject to be aware of, inter alia, the type of data to be processed, the identity of the controller, the period and procedures for that processing and the purposes of the processing. Such information must enable the data subject to be able to determine easily the consequences of any consent he or she might give and ensure that the consent given is well informed (see, by analogy, judgment of 1 October 2019, Planet49, C‑673/17, EU:C:2019:801, paragraph 74).