logopers
  • HOME
  • NEWS
  • LAW
  • IT
  • ABOUT US
  • GET IN TOUCH
  • French
  • Spanish
Suivez nous !
Facebook
Instagram
Linkedin
Twitter
Youtube
RSS Feed
  • Español
  • Français
  • English
Logo a réviser bleu
logopers
  • HOME
  • NEWS
  • LAW
  • IT
  • ABOUT US
  • GET IN TOUCH
  • French
  • Spanish
consent, GDPR, consentement, privacy, freedom of choice,

The Responsibility of processing user data

European law, IT law
-
No Comments Yet

The GDPR has put in place information obligations on those responsible for processing user data as well as various constraints. One of these constraints is the obligation to obtain the consent of the person concerned by the use of the data. But how should this consent be obtained?

 

 

 

 

The judgment of the CJEU on the matter of November 11, 2020

 

On November 11, 2020, the CJEU rendered a judgment in which it clarified the terms and conditions to be observed with regard to the terms and conditions for collecting consent under the GDPR.

In this case, the telecommunications service provider Orange România brought an appeal against a decision of the Romanian data protection authority pronounced on March 28, 2018. By this decision, the supervisory body sanctioned the company Orange for having kept copies of the identity documents of its new customers following the conclusion of new contracts for mobile telecommunications services, without having obtained the consent of said customers. These contracts were concluded prior to the enactment of the GDPR.

The contracts contained clauses according to which the customer was informed and gave his consent to the retention of official documents containing personal data for identification purposes as well as to the processing of his personal data. This declaration of consent was made by means of a checkbox by the client. However, according to the findings of the Bucharest court, some contracts already contained a cross in the checkbox while in others, the presence of the cross was lacking.

In view of these elements, the national courts have been led to put two preliminary questions to the Court of Justice of the European Union.

 

The issues of the shutdown

 

 

The first question which arises is that of knowing, ‘ Within the meaning of Article [2] (h) of Directive 95/46, what are the conditions which must be fulfilled in order to be able to consider that a manifestation of will is specific and informed? ”.

Next, the judges wondered about the fact of knowing, “ Within the meaning of Article 2 (h) of Directive 95/46, what are the conditions which must be fulfilled in order to be able to consider that a manifestation of will is freely expressed? ”.

The two questions were examined jointly by the Court. More simply, national judges ask themselves on what criteria should they base themselves to determine that the manifestation of will is the expression of a consent given in a free and informed manner by the customers, with regard to the GDPR.

First, the European judges recall the context in which the decision was rendered: the Romanian data protection authority issued its decision prior to the entry into force of the GDPR. The Romanian data protection authority not only fined Orange România but also ordered it to destroy the copies of the credentials in question. The CJEU considered that the RDPG was applicable in the present case.

 

 

 

Then, concerning the methods of collecting consent in European law, the European judges first looked at the interpretation of the GDPR. They recalled that Directive 95/46 defines consent as “ any free, specific and informed manifestation of will by which the data subject accepts that personal data concerning him / her may be processed < / em>. “(Article 2, point h). And in accordance with Article 7 (a), the person must have “ unambiguously given consent “. From these two concepts, it emerges that the data subject must have an active approach in the manifestation of his consent for him to be qualified as such within the meaning of the GDPR.

 

The limits of the RGPD

 

The GDPR was reformed by a regulation of April 27, 2016, the concept of consent was taken even further. Indeed, the wording of Article 4 (11) of that regulation, which defines ‘ consent of the data subject ‘ appears even stricter than that of Article 2 (h) , of Directive 95/46, in that it requires a”free, specific, informed and unambiguous expression of will by which the data subject accepts, by a declaration or by a clear positive act, that personal data concerning him / her may be processed </ em> ”. This requested positive act must mark the data subject’s acceptance of the processing of their personal data.

Thus, the GDPR in force today expressly provides for active behavior in the issuance of consent. On this notion of active behavior, the European judges consider that it cannot be given “in the event of silence, boxes checked by default or inactivity”. The Court reiterates that the burden of proof of the granting of consent rests on the controller. In this case, it is the responsibility of Orange România to demonstrate that their co-contractors have consented to the processing and storage of their data.

But in the present case, the Court considers that the clients do not seem to have been able to manifest their consent through active behavior because the box which had to be checked to externalize the consent was already checked. Consequently, there is nothing to establish that customers are aware of the methods of use of their personal data. It emerges from the judgment of this decision that the request for consent concerning the processing of user data must be presented “in a form which clearly distinguishes it from other contractual clauses” when it is requested in the context of a written declaration which concerns questions other than that of data processing. It is up to the fund judges to decide whether expressing consent through a checkbox can be considered specific consent.

Finally, one of the fundamental concepts mentioned in this judgment is the “free” nature of consent because by checking the box which, originally, was intended to allow consent to be expressed, the Orange România company requires its customers a written declaration in which they oppose the collection of their data. For the European judges “ the free choice to oppose this collection and this conservation is unduly affected by this person in charge, by requiring that the person concerned, in order to refuse to give his consent, fill out an additional form stating of this refusal. ”

In addition, customers are not informed of the consequences of refusing to collect and keep copies of their identity documents on the conclusion of a contract with Orange România. Thus, “the contractual provisions of said contract are likely to mislead the data subject in error as to the possibility of concluding the contract in question even if he refuses to consent to the processing of his data”.

 

 

 

The issues of the Orange Romania shutdown in relation to the GDPR

 

As a result, with this judgment, the CJEU has strengthened the requirements for obtaining valid consent under the GDPR by specifying three points. First, it requires that people be informed of the consequences of their consent and how the data will be processed. Then, it requires data controllers not to mislead the persons concerned by the data processing on the possibility of refusing the processing operations while concluding the service agreement. Finally, it prohibits data controllers from requiring that individuals fill out forms or take any other specific measure to be able to refuse the processing of their data.

It emerges from this solution that the essential condition for being able to collect and process clients’ identity documents is the collection of their consent. The GDPR provides for an exhaustive list of cases in which data processing can be considered lawful. For example, the processing of personal data is lawful when it “is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the latter’s request. “. Couldn’t the Orange România data controller have relied on this contractual necessity to collect the identity documents? Or could he not have demonstrated a legitimate interest in collecting the data? The judges are not providing any response in connection with this judgment, it remains silent on the other conditions allowing data controllers to lawfully collect user data.

 

A continuing case law in the field of IT

 

This judgment is in line with the Planet 49 judgment dated 1 st October 2019 by which the CJEU had the opportunity to specify the procedures to be observed with regard to the collection of consent during the use of cookies. European judges have prohibited the pre-ticking of boxes on a cookie notice. They consider that the only form of expression of valid consent is that which results from a positive and affirmative action on the part of the user who agrees to share their personal data. Consequently, the user’s consent to the use of tracers cannot be considered valid when it results from a box checked by default that the user must uncheck to refuse to give consent.

What are the consequences of these decisions for German websites? Platform managers must ensure that users of the platform have full access to information relating to cookies. Then, it is necessary to ensure that the user behaves actively in expressing his consent to his data being disclosed, for example, checking a box, pressing a validation button cookies may meet this criterion. Finally, a company should never access a user’s personal information without first ensuring that the user has consented to its disclosure.

Following this first judgment, on May 4, 2020 the European Data Protection Board published guidelines on consent within the meaning of the GDPR in which it confirms the orientation of the CJEU. It clarifies what is valid consent and confirms that it is illegal to use a “cookie wall” as a means of obtaining consent. What is valid consent under the EDPB guidelines? The authority sets four criteria for consent to be considered valid: it must be freely given, specific, informed and unambiguous. It is now necessary to define more precisely what these four criteria consist of.

 

 

 

A different solution in Swiss law.

 

European law differs fundamentally from the Swiss system which provides, by the Federal Data Protection Act of 19 June 1992 , that telecommunications service providers must, in the context of mobile communication services, verify the identity of the user “ the identity of the user by means of a passport, an identity card or a residence permit ”when the means of access are given or the service is activated for the first time. In addition to this verification, Swiss regulations establish a legal obligation to retain customer information: “ A legible copy of the identity document must be kept . “. Nevertheless, there are many similarities between Swiss law and European law. Indeed, as in European law, Swiss law places the concepts of “freedom” and “ information ” at the heart of the definition of consent by considering that “ the person concerned does not consent valid only if it expresses its will freely and after having been duly informed ”. Consent is a way of overcoming the legal prohibition on data disclosure: through the free and informed will of the data subject, it is possible to communicate personal data. Swiss regulations provide an additional clarification regarding “sensitive data”: “ his consent must also be explicit ”. European regulations are much less precise: “ This regulation also leaves Member States a margin of maneuver to specify its rules, including with regard to the processing of special categories of personal data (hereinafter referred to as “Sensitive data “) “. It is therefore necessary to examine the regulations of each state to know how this data can be used.

Eternoscorp remains at your disposal to assist you in processing your users’ data in accordance with applicable regulations.

0 0 votes
Article Rating
Tweet
Share
WhatsApp
Telegram
Share
Share
Email
Print
0 Shares
Tags
data
privacy
responsability
user data
PREVIOUS POST
Territorial jurisdiction in trademark law
NEXT POST
The obligation to establish fair remuneration for performers who are not members of the EEA

Fabregue

Mr. Fabregue was Eternos Corporation Head of Legal up until 2020, where he headed the legal department.

Besoin de conseils en lien avec ce sujet ?

Faites appel à nos experts !

   
PREMIER RDV GRATUIT 
   
Contactez-nous
       
   

Que pensez-vous de cette analyse ?

Réagissez !

Contact
Subscribe
Login
Notify of
guest
guest
0 Comments
Inline Feedbacks
View all comments

Related Posts

Related posts that you should not miss.

Sampling and copyright infringement

European law, Tax and corporate law
The field of intellectual property is extremely wide, it includes everything called "intellectual works", including patents, trademark law, copyright etc. Intellectual property is protected as much by European…
READ MORE →
10 Min Read
euros

Transfer price

European law, Tax law
Whenever a multinational enterprise wishes to carry out transactions, it must have the capacity to meet the costs surrounding it: these are transfer pricing. These are the prices…
READ MORE →
12 Min Read
made in the eu

An agreement

EU Private markets and equity, European law, Tax law
The European internal market is based on the idea that healthy competition is good for the market and good for consumers. Any obstacle to this competition will negatively…
READ MORE →
13 Min Read
Nos analyses les plus consultées :
  • pass sanitaire
    11/12/2021
    Sanitary Pass
  • graph
    11/12/2021
    CSR: the issue of corporate social responsibility
  • DSA
    11/12/2021
    Digital services regulation proposal
Suivez-nous
© Eternos Corporation LTD. 2018-2021
Developed with love in Ireland        |      Legal Notice & Privacy Policy      |      Cookie Policy
The Responsibility of processing user data ⋆ Eternos Corporation
wpDiscuz
0
0
Would love your thoughts, please comment.x
()
x
| Reply
Comment Author Info
Manage Cookie Consent
We use cookies to optimize our website and our service.
Functional cookies Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
View preferences
{title} {title} {title}
:wpds_smile::wpds_grin::wpds_wink::wpds_mrgreen::wpds_neutral::wpds_twisted::wpds_arrow::wpds_shock::wpds_unamused::wpds_cool::wpds_evil::wpds_oops::wpds_razz::wpds_roll::wpds_cry::wpds_eek::wpds_lol::wpds_mad::wpds_sad::wpds_exclamation::wpds_question::wpds_idea::wpds_hmm::wpds_beg::wpds_whew::wpds_chuckle::wpds_silly::wpds_envy::wpds_shutmouth:
You are going to send email to

Move Comment
Translate into
AfrikaansAlbanianArabicArmenianAzerbaijanBasqueBelarusianBosnianBulgarianCatalanChineseCroatianCzechDanishDutchEnglishEstonianFinishFrenchGalicianGeorgianGermanGreekHaitian(Creole)HungarianIcelandicIndonesianIrishItalianJapaneseKazakhKoreanKyrgyzLatinLatvianLithuanianMacedonianMalagasyMalayMalteseMongolianNorwegianPersianPolishPortugueseRomanianRussianSerbianSlovakianSlovenianSpanishSwahiliSwedishTagalogTajikTatarThaiTurkishUkrainianUzbekVietnameseWelshYiddish