What the ECJ ruling of 01.10.2019 means for practice
The ECJ had to deal with the following summary questions in a preliminary ruling procedure:
- Is it consent if the storage of information or access to information by information or access to information is permitted by a pre-set by a pre-set checkbox which the user must uncheck in order to refuse consent? to refuse consent?
- Does it does it make a difference whether the information stored or accessed is personal data? information is personal data?
- What information does the service provider have to provide to the user as part of the clear and comprehensive information to be provided? comprehensive information to be provided to the user? Does this also include the the duration of the function of the cookies and whether third parties have access to the cookies? access to the cookies?
What had happened?
In September 2013, Planet49 GmbH organised a prize draw on the website website www.dein-macbook.de for advertising purposes. Interested Internet users had to enter their name and address with postcode in order to take part in the take part in the competition. Furthermore, the internet users had to agree to at least one of two possible advertising uses of their personal data. their personal data. The organiser provided two checkboxes for this purpose, one of which already contained a pre-set check mark. The consequence of this (when participating in the competition) was that a cookie was placed on the user's computer. the Internet user's computer, which was used by Planet49 GmbH to advertising purposes for products of the partners of Planet49 GmbH.
After an unsuccessful warning from the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V.). court in Frankfurt am Main, according to which the box that was brought forward box is invalid as a declaration of consent and may no longer be required by Planet49 GmbH. may no longer be required from Planet49 GmbH.
The Frankfurt am Main Higher Regional Court upheld the appeal of the appeal of Planet49 GmbH. The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V.) appealed to the Federal Court of Justice (Bundesgerichtshof), which has now decided the issues. the European Court of Justice to clarify the relevant questions of interpretation. submitted.
How did the ECJ rule?
With regard to the questions referred for a preliminary ruling, the ECJ came to the following the following results:
Active consent of internet users required
Effective consent shall not be deemed to exist if the storage of information or access to information is permitted by a checkbox pre-set by the by the service provider which the user must uncheck in order to refuse consent. which the user must deselect in order to refuse consent.
In accordance with the provisions in the GDPR on consent the ECJ speaks of the requirement of "active consent" of internet consent" of the internet user.
All cookies are affected
It does not matter in legal terms whether the information stored or information stored or accessed in the terminal device of the user of a website is is or is not personal data within the meaning of Directive 95/46 or Regulation 2016/679. or not.
The website operator must provide comprehensive explain the function of the cookies
The website operator must inform the internet user about the of the cookie, the identity of the data controller, the purpose of the controller, the purpose of the processing for which the data are intended, and purpose of the processing for which the data are intended and of other information or categories of recipients of the data.
What are the implications of the ECJ for practice?
The ECJ's ruling will initially have a direct effect initially only for the parties to the proceedings. The Federal Supreme Court will presumably the pending appeal proceedings, taking into account the ECJ's ruling. in favour of the appellant. This means that the forwarded box is ineffective as a declaration of consent and may not be further may no longer be required. In this case, for the first time "supreme court" jurisprudence on the subject of the need for consent in the case of cookies!
It is therefore to be expected and also to be feared that all data protection supervisory authorities will follow the judgement of the ECJ and also the BGH and and critically examine the current practice of including cookies by website operators. website operators critically.
If website operators want to choose the legally safest they must refrain from using cookies altogether until further notice. This is likely to cause a considerable economic problem for many website operators, because they are they are either technically dependent on the use of cookies (e.g. session cookies to session cookies for the functioning of the shopping basket) or they generate a significant part of their added value directly through the use of (advertising) cookies. generate. In the near future, therefore, the following questions will certainly be asked by the authorities, the courts and the legislator:
- Must or should technically necessary cookies be exempt from the consent requirement? be exempted?
- How detailed does the information about how the cookies work need to be?
- Does the consent to the use of each cookie separately, or is it sufficient to or is a "total consent" also sufficient (after correspondingly detailed information)? "Overall consent"?
Source: Judgment of the ECJ of 01.10.2019, Ref. C-673/17
GoldbergUllrich Attorneys at Law 2019
Julius Oberste-Dommes LL.M. (Information Law)
Lawyer and
Specialist lawyer for information technology law
