LUXEMBOURG (CN) — EU law protects consumers from having to opt out of data-sharing agreements in a contract, the European Court of Justice ruled.
The dispute stems from cellphone contracts that Orange România, Romania's largest mobile service provider, rolled out in 2018 where a box that indicated the customer had given consent for the company to collect and store customers identification documents was already selected.
Romania’s data privacy watchdog, the National Authority for the Supervision of Personal Data Processing, or ANSPDCP, intervened, fining the company for a breach of EU privacy regulations and ordering the company to destroy any data it had collected.
Under the 27-member-state’s 2016 General Data Protection Regulation, consent to share data, “should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication.” The regulation specifically forbids the use of pre-selected boxes: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”
Orange România contested the regulatory decision, arguing that it provided customers with all of the information they needed to decide how to proceed and that it didn’t refuse customers who unselected the box. Customers who wished to opt out, however, had to complete a second, specific form indicating that.
The Regional Court in Bucharest referred the matter to the Court of Justice, asking the Luxembourg-based court to clarify the criteria for determining whether consent is “specific” and “informed” as the General Data Protection Regulation requires.
“Since … the customers concerned do not appear to have themselves ticked the box relating to that clause, the mere fact that that box was ticked is not such as to establish a positive indication of those customers’ consent to a copy of their identity card being collected and stored,” the court found Wednesday.
The judges found further fault with the company’s opt-out procedure. “An additional requirement is liable to affect unduly the freedom to choose to object to that collection and storage,” they wrote.
The court has sided frequently with consumers over companies in data-privacy cases. It famously overturned a data-sharing agreement between the EU and the United States in 2015 and then called the replacement agreement in question earlier this year. Last month, the court held European spy agencies can only keep bulk personal data in the event of a serious emergency. Later this year, the court is expected to rule on a case that would allow more scrutiny over data privacy by member states.
The Orange România case will now return to the Romanian court for a final ruling.
“The company cannot require them actively to express their refusal,” Wednesday’s ruling states.
Follow @mollyquell
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
Additional Reads
-
Lead in Lunchables April 19, 2024 -
