Inteligo Media SA – CJEU Judgment (Romania, 2025)

Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service). On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose. The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court. In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: #In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free