Wikipedia

German Federation of Consumer Organisations v Planet49 GmbH

Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH (2019) Case C‑673/17 is a decision of the Court of Justice of the European Union (CJEU, Court) on the consent requirement for the placement of cookies under Article 2(f) and Article 5(3) of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (‘ePrivacy-Directive’), as amended by Directive 2009/136/EC.

German Federation of Consumer Organisations v Planet49 GmbH
European Court of Justice
Decided 1 October 2019
Full case nameBundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH
CaseC-673/17,
CelexID62017CA0673
Case typeReference for a preliminary ruling
ChamberFull court
Nationality of partiesGermany
Procedural historyBundesgerichtshof, Az. I ZR 7/16, request for a preliminary ruling under Article 267 TFEU by decision of 5 October 2017
Court composition
Judge-Rapporteur
Allan Rosas
Advocate General
Maciej Szpunar
Legislation affecting
Article 2(f) and of Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009

The judgment was based on a request for a preliminary ruling under Article 267 TFEU from the Federal Court of Justice of Germany.

The Court established that a web site cannot legitimately seek consent under the ePrivacy-Directive using pre-ticked checkboxes. The standard established by the General Data Protection Regulation (‘GDPR’) applies to the consent requirement for the placement of cookies under the ePrivacy-Directive. In addition to that, the Court clarified that Article 5(3) of the ePrivacy-Directive does not only apply to the collection of personal data, but to the collection of any information. In response to the second question of the German Federal Court, the European Court of Justice decided that in order to meet the requirement to provide "clear and comprehensive information", the website operator must provide information to the user on the duration of the operation of cookies and whether or not third parties may have access to those cookies.[1]

Facts

edit

Planet49 GmbH (‘Planet 49’) ran a promotional lottery on the website www.dein-macbook.de. Upon entering the lottery, users were required to provide their name, address and post code. They were then presented with two checkboxes. The first checkbox was unchecked and required the consent to receiving third party advertising. It was mandatory for the user to tick this box in order to enter the competition. The second checkbox was pre-checked and allowed Planet49 to set cookies to track the user’s online behaviour using a web analytics firm called Remintrex. Users were able to opt-out of the use of cookies by unchecking the box. They could still participate in the lottery, if they did not consent to the use of cookies.

The German Federation of Consumer Organisation brought an action against Planet49 claiming that the two checkboxes were not compliant with German law requirements and sought an injunction to cease using them against Planet49.

The questions referred to the Court of Justice only concerned the second pre-ticked checkbox.

Ruling

edit

German courts

edit

In the prior proceedings in Germany, the Landgericht Frankfurt am Main (Regional Court) upheld the action for an injunction by the Bundesverband and required Planet49 to cease using such consent declarations. The Oberlandesgericht Frankfurt am Main (Higher Regional Court) upheld the injunction regarding the first checkbox, but held that the statement for the pre-checked checkbox was compliant with the requirements for consent to the use of cookies under the relevant legislation. Both parties have appealed against the decision. The German Federal Supreme Court suspended the proceedings by order of 5 October 2017 and referred various questions to the European Court of Justice on the interpretation of Union law regarding the effectiveness of consent to the setting of cookies by means of a pre-ticked checkbox.

Court of Justice of the European Union

edit

The CJEU first addressed the question, whether consent can be validly obtained under Article 2(f) and Article 5(3) of the ePrivacy-Directive by a pre-ticked checkbox. The CJEU turned to the ePrivacy-Directive and interpreted the term ‘indication’ as a requirement for active behaviour by the user. The Court points out that

it would appear impossible in practice to ascertain objectively whether a website user had actually given his or her consent to the processing of his or her personal data by not deselecting a pre-ticked checkbox nor, in any event, whether that consent had been informed.[2]

It is not sufficient that the users selects the button to participate in the promotional lottery, but the consent must specifically relate to the processing of the data in question.[3] The Court underlines its decision by stating that the GDPR explicitly requires active consent pursuant to Article 4(11) and Article 6(1)(a). Recital 32 of the GDPR expressly precludes "silence, pre-ticked boxes or inactivity" from constituting consent.[4]

Secondly, the German Federal Court asked "whether Article 2(f) and Article 5(3) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46 and Article 6(1)(a) of Regulation 2016/679, must be interpreted differently according to whether or not the information stored or accessed on a website user’s terminal equipment is personal data within the meaning of Directive 95/46 and Regulation 2016/679."[5] The CJEU notes

that Article 5(3) of Directive 2002/58 refers to ‘the storing of information’ and ‘the gaining of access to information already stored’, without characterising that information or specifying that it must be personal data. As the Advocate General stated in point 107 of his Opinion, that provision aims to protect the user from interference with his or her private sphere, regardless of whether or not that interference involves personal data.[6]

This shows that the consent requirement of Article 5(3) ePrivacy-Directive matches the consent requirement under the GDPR, regardless of whether the information stored is personal data.

In the last part of its judgment, the CJEU addresses the question whether the website provider must provide information on the duration of the operation of cookies and whether third parties have access to these cookies in order to provide "clear and comprehensive information". A user should

be able to determine easily the consequences of any consent he or she might give and ensure that the consent given is well informed.[7]

The list of information to be provided to the data subject under Article 10 of Directive 95/46 is not exhaustive. The CJEU ruled that information on the duration of the operation cookies shall be provided in order to meet the requirement of fair data processing.[8] The CJEU also refers to Article 10(c) of Directive 95/46 and Article 13 of the GDPR that require the information on recipients or categories of recipients of the data to be included in the information.[9] The website provider must therefore include information on the duration of the placement of cookies and whether third parties have access to these cookies.[10]

Aftermath

edit

After the CJEU had answered the questions in its judgment of 1 October 2019, the German Federal Court continued the oral proceedings in the case. The oral hearing took place on January 30, 2020. The date of the delivery has been set for 28 May 2020.[11]

Pursuant to Section 15(3) of the German Telemedia Act (TMG), a service provider is allowed to create user profiles, provided that the users do not object. Advocate General (AG) Szpunar pointed out in his opinion that the requirement, in so far as no personal data are involved, is less strict under German law.[12] In accordance with the reply of the CJEU, it does not make a difference for the consent requirement, whether the information stored or accessed constitutes personal data.[13] Szpunar criticizes that Section 15(3) of the TMG does not fully transpose the requirements of Article 5(3) of Directive 2002/58 into German law.[14]

The German Federal Ministry of Economic Affairs and Energy has announced in response that the German Telemedia Act will be revised taking into account the judgment.[15]

The Court’s decision is of general importance for the use of cookies and not only in the specific case of pre-ticked checkboxes. In paragraphs 54 and 55 of the ruling, the Court clarified that only informing users that they consent to the placing of cookies by continuing their activity on a website is not sufficient to obtain valid consent under the ePrivacy-Directive.

Discussion

edit

In general the Court’s decision has been welcomed. Schüßler/Fenelon conclude that the ruling of the Court of Justice was “unsurprising and largely in line with recent regulatory guidance on the use of cookies and similar technologies.”[16]

A few things remain unclear. The Court clearly points out that the referring German court did not refer the question whether it is compatible with the requirement of "freely given" consent to the processing of personal data for advertising purposes, if the consent is a prerequisite to the user’s participation in a promotional lottery.[17] AG Szpunar shortly addresses this in paragraphs 97-99 of his opinion, referring to the 'prohibition on bundling' codified in Article 7(4) of the GDPR.[18]

See also

edit

References

edit
  1. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 81.
  2. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 55.
  3. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 58.
  4. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 62, 63.
  5. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 66.
  6. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 69, 69.
  7. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 74.
  8. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 78.
  9. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 80.
  10. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 81.
  11. ^ Press release of the German Federal Court of Justice announcing the date of delivery of the new ruling
  12. ^ Opinion of Advocate General Szpunar delivered on 21 March 2019. Case C-673/17, para. 103.
  13. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 71.
  14. ^ Opinion of Advocate General Szpunar delivered on 21 March 2019. Case C-673/17, para. 109.
  15. ^ Dachwitz, I. (2019).“Wirtschaftsministerium will im Herbst neue Regeln für Online-Tracking vorschlagen”.
  16. ^ Schüßler, F. and J. Fenelon (2019). “Planet 49: CJEU Rules on Cookie Consent”.
  17. ^ Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, para. 64.
  18. ^ Opinion of Advocate General Szpunar delivered on 21 March 2019. Case C-673/17, para. 97-99.
edit
Retrieved from "https://en.wikipedia.org/w/index.php?title=German_Federation_of_Consumer_Organisations_v_Planet49_GmbH&oldid=978310941"