03/10/2019
The Court of Justice of the European Union (CJEU) ruled on that the consent is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent.
CJEU has analysed the case of Planet49 GmbH, an online gaming company, which organised a promotional lottery on its website on 24 September 2013. A person who wanted to take part in the lottery should have completed the registration form below which were two bodies of explanatory text accompanied by checkboxes. The second checkbox regarding cookies consent contained an already preselected tick which could lead to a situation in which everyone who took part in the lottery automatically agreed to the installation of cookies.
In the ruling, CJEU referred to the provisions of legal acts regulating personal data protection (Directive 2002/58/EC, Directive 95/46/EC or Regulation (EU) 2016/679) in order to explain the meaning of terms as ‘giving consent’, ‘freely given, specific, informed and unambiguous indication of the data subject’s wishes’ or ‘clear affirmative action’.
CJEU has emphasized that consent to place cookies files on the website users’ terminal equipment shall always be active and certain clear and active steps shall be taken by the website user when giving its consent. It means that that consent cannot validly be obtained through the use of pre-checked boxes as it does not imply active behaviour on the part of a website user.
The CJEU also considered the issue whether a provider of a website is obligated to inform the website user about the duration of the operation of cookies and whether or not third parties may have access to those cookies. The CJEU has stated that, although the duration of the processing of the data is not included as part of the information which shall be given to the website user under the provisions of the Directive 95/46/EC, the duration of the operation of cookies must be regarded as meeting the requirement of fair data processing provided for in that Directive 95/46/EC. In result, the CJEU by referring to the principles of fair and transparent data processing came to the conclusion that the above-mentioned information about the duration of the operation of cookies and whether or not third parties may have access to those cookies shall be also clearly indicated to the website user.
In accordance with the judgment of the CJEU, ECOVIS ProventusLaw suggests website providers who place cookies on the website users’ terminal equipment to review privacy policies and/or cookies policies in order to ensure that all required information to be provided to the website user is indicated therein, as well as review cookies notice (pop-ups) on websites regarding the way in which that consent is given.
If you need more information or help with privacy policies, cookies policies and cookies notices review in order to comply with data protection rules, please do not hesitate to contact us.
Newsletter Subscription
Get in touch