On 21 March 2019, Advocate General ("AG") Maciej Szpunar issued an opinion in case C-673/17 (Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.) concerning consent to the use of cookies and other pertinent questions of EU data protection law. In particular, the AG addressed the issues of "valid consent"; the scope of the obligation to provide clear and comprehensive information to users; and consent bundling.

Background

The case concerned an online lottery organised by the defendant Planet49. Participants to the lottery were shown two checkboxes on the screen where they needed to click a "participation button". The first checkbox required consent for marketing e-mails from a range of firms and had to be ticked for the purposes of participation in the lottery. The second asked for the user's consent to the installation and storage of cookies, i.e., small pieces of data or text files allowing the website to "remember" the user's actions or preferences over time. The latter was not mandatory, but the checkbox was pre-ticked so that the user had to take an active step to object to the cookies (opt-out). The claimant – the Federation of German Consumer Organisations (Bundesverband der Verbraucherzentralen) - argued before the German courts that this form of obtaining consent was in breach of German law. After lengthy proceedings, the Court of Justice of the European Union ("ECJ") was asked to rule upon the conformity of the conduct of Planet 49 with EU law by way of a preliminary ruling under Article 267 of the TFEU. The questions related (i) to the conditions for valid consent; and (ii) which information users should receive regarding the use of cookies.

Active and Separate Consent

In his opinion, the AG discussed the notion of valid consent within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereafter the "GDPR") and Directive 95/46/EC which was repealed by the GDPR, as well as under the ePrivacy Directive (Directive 2002/58/EC). After recalling the need for an active and separate consent of the data subject which has to be freely given on the basis of clear and comprehensive information, the AG inferred that permission for the installation of cookies by way of a pre-ticked checkbox does not constitute valid consent under EU law.

On one hand, the requirement to refuse cookies explicitly by unticking a box did not, in his view, entail active approval due to the impossibility to "determine objectively whether or not a user has given his consent on the basis of a freely given and informed decision". According to the AG, a positive expression of acceptance would thus have been a far better guarantee as compared to mere inaction.

On the other hand, consent must be 'separate' and, as a result, the act that a user pursues (i.e., participation in the lottery), and the permission of cookies should not form part of the same act, (i.e., hitting the "participation" button). Rather, two distinct expressions of intent must be made without one being ancillary to the other.

Turning to the checkbox dealing with the processing of personal data for the purposes of marketing communication, the AG observed that a separate click button would have better guaranteed the existence of a separate consent. Furthermore, he discussed the "prohibition on bundling" under Article 7(4) of the GDPR. This rule requires any assessment as to whether permission is freely given to take into account whether the performance of a contract is made conditional on consent to the processing of personal data not necessary for the purposes of contract performance. In the case at hand, it was not clear whether a user had to consent to receiving marketing materials in order to participate in the lottery. In the AG's view, the "marketing checkbox" appeared to be a necessary condition for participation in the lottery.

Clear and Comprehensive Information

With respect to the question concerning the scope of the obligation of providers to give clear and comprehensive information to the data subject, the AG indicated that the user should be put in a position to learn easily about the consequences of any consent he or she might give. The information provided must therefore be "clearly comprehensible and not be subject to ambiguity or interpretation". Moreover, it has to "enable the user to comprehend the functioning of the cookies actually resorted to". Consequently, clarity about the time period for storage and whether or not third parties have access to the data should exist as ingredients of the informed consent. In the event that third parties may access the information, their identity must be disclosed. In addition, users must be aware of the types of processed data and the purposes for which this is done.

Implications

While not binding on the Court, the ECJ usually follows the AG's opinion. Its judgment is expected to be handed down still in 2019.

In addition, the AG's opinion may have implications on the discussions concerning the proposed ePrivacy Regulation which will update the ePrivacy Directive and complement the GDPR with specific rules on cookies.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.