In the case of Orange România SA v Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, the Romanian Court of Justice were faced with the question whether ticking a box would be a valid form of consent for the purposes of data processing in accordance with GDPR.
Orange România SA v Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
What happened in this case?
Orange Romania are a mobile phone company. When entering into new contracts with customers they would take copies of the customers’ ID documents and annex them to the contract. The Romanian supervisory authority concluded that Orange were not obtaining valid consent to process the data and therefore issued Orange with a fine.
Orange disputed the fine claiming that they obtained customers’ consent orally to collect and store their ID documents and once the consent had been obtained a box in the contract would be ticked by the sales agent to confirm the consent.
The question faced by the Court was whether this amounts to valid consent in accordance with data protection law?
What was decided?
The Court of Justice made it clear that the onus is on the data controller to demonstrate that the data subject consented to the processing of the personal data.
They concluded that the fact that the customers signed the contracts containing the tick box confirming that they provided such consent was not enough to establish the relevant consent. The Court of Justice took particular issue with the fact that the data subject did not tick the box themselves but it instead was done by the data controller.
What can we take from this decision?
It is for the controller to demonstrate that the data subject had been given the required information in an appropriate form and had consented accordingly.
Simply ticking a box on behalf of the data subject confirming that they have consented is not enough. Whilst this judgment does not go on to state whether it would amount to consent had the individual ticked the box themselves, given the general comments made by the Court of Justice it seems unlikely that this would suffice particularly if the document does not detail the individual’s rights, etc., in respect of processing of their data.
How can Nelsons help?
Ruby Ashby is an Associate in our expert Dispute Resolution team.
Should you be affected by any data protection or other privacy issues, please feel free to contact Ruby or another member of the team in Derby, Leicester or Nottingham on 0800 024 1976 or via our online enquiry form.