Inteligo Media SA – CJEU Judgment (Romania, 2025)

Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service). On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose. The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court. In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: #In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free daily newsletter: ##(a) is that email address obtained by the publisher of the online news publication “in the context of the sale of a product or a service” within the meaning of Article 13(2) of Directive 2002/58 ('e-privacy Directive')? ##(b) is the transmission by the news publisher of a newsletter such as that described in the abovementioned point (ii) carried out “for direct marketing of its own similar products or services” within the meaning of Article 13(2) of [Directive 2002/58]? #If the answers to Question 1(a) and (b) is "yes", which of the conditions laid down in Article 6(1)(a) to (f) of [the GDPR] apply when the publisher uses the user’s email address for the purpose of sending a daily newsletter [...], in accordance with the requirements of Article 13(2) 'e-privacy Directive'? #Does Article 13(1) and (2) 'e-privacy Directive' preclude national legislation which uses the concept of “commercial communication” laid down in Article 2(f) of [Directive 2000/31/EC] instead of the concept of “direct marketing” laid down in the 'e-privacy Directive'? If not, does a newsletter [...] constitute a “commercial communication” within the meaning of Article 2(f) of [Directive 2000/31]? #If the answers to Question 1(a) and (b) are in the negative: ##(a) does the transmission via email of a daily newsletter[...] constitute “use … of electronic mail for the purposes of direct marketing” within the meaning of Article 13(1) 'e-privacy Directive'? ##(b) must Article 95 GDPR, in conjunction with Article 15(2) 'e-privacy Directive', be interpreted as meaning that failure to comply with the conditions for obtaining valid consent from the user pursuant to Article 13(1) 'e-privacy Directive' will be penalised in accordance with Article 83 GDPR or in accordance with the provisions of national law contained in the act transposing the 'e-privacy Directive', which contains specific penalties? #Must Article 83(2) GDPR be interpreted as meaning that a DPA which decides whether to impose an administrative fine and decides on the amount of the administrative fine in each individual case is obliged to analyse and explain in the administrative act imposing the fine the effect of each of the criteria laid down in points (a) to (k) on the decision to impose a fine and, respectively, on the decision regarding the amount of the fine imposed? = # The newsletter constitutes direct marketing # Article 13(2) 'e-privacy Directive' is lex specialis to Article 6(1) GDPR # The DPA must not necessarily explain all criteria in Article 83(2) GDPR when imposing fines = The AG summarized that the referring court seeks to ascertain, in essence, whether it can be considered that a user’s email address obtained when he or she creates an online account entitling them to free access to a number of articles/resources and to receive, by email, a daily newsletter, is obtained ‘in connection with the sale of a product or a service’ and whether the transmission of the daily newsletter constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of Article 13(2) 'e-privacy Directive'. The AG considered CJEU, C-484/14, McFadden, opining that the Personal update pursued an advertising purpose which in turn constitutes an indirect form of remuneration which satisfies the CJEU’s definition of a ‘sale’. Thus, the AG opined that Article 13(2) 'e-privacy Directive' must be interpreted as meaning that a user’s email address obtained when he or she creates an online account entitling him or her to a 'Personal Update' such as the one in question constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of that provision. = The AG opined, that Article 95 GDPR establishes the principle lex specialis derogat legi generali for the relationship between that directive and the GDPR: whenever there is a specific provision in Directive 2002/58 entailing obligations with the same objective as corresponding provisions in the GDPR, it is the provision 'e-privacy Directive' which must be applied. The AG held, that Article 13(2) 'e-privacy Directive' comprehensively governs the conditions and purposes of the processing as well as the rights of the data subject and imposes ‘specific obligations’ on the controller, within the meaning of Article 95 GDPR including specifically the question of consent. As a consequence, the AG found, that recourse to the GDPR, in particular Article 6(1)(a) to (f) GDPR, is neither possible nor necessary. = The AG considered the question, if Article 13(1) and (2) 'e-privacy Directive' precludes transposing national legislation which replaces the term ‘direct marketing’ with the term ‘commercial communication’, as defined in Article (2)(f) of Directive 2000/31 to be hypothetical with respect to the case at issue and therefore inadmissible. The AG opined that, commercial communication has a wider scope that encompasses the concept of direct marketing; thus all direct marketing constitutes commercial communication, but not all commercial communication constitutes direct marketing. = The AG summarised the question as to whether, when a DPA imposes an administrative fine, it is required to analyse and explain in the administrative act concerned the impact of each of the criteria provided for in Article 83(2)(a) to (k) GDPR. Since that question refers to the eventuality that the GDPR is applicable to the present case, the AG responded only in case that the CJEU should decide contrary to his Opinion above. The AG concluded, that as long as an individual can understand the grounds of the individual measure adversely affecting them, the obligation springing from the principle of respect for the rights of the defence) of the administration to state reasons for a decision which are sufficiently specific and concrete is complied with, without it being necessary to go into detail regarding each of the criteria listed in Article 83(2) GDPR. = == The Court referred to its existing case-law when explaining the concept of communications ‘for the purpose of direct marketing’. It highlighted that the concept covers communications which pursue a commercial purpose and are addressed directly and individually to a customer (Case C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz, para 47, available here), such as advertising messages promoting services in the form of emails sent to the user’s inbox. The Court held that the communication was intended to entice users to access the paid content provided by the published, thus promoting the sale of that content and pursuing a commercial purpose. Lastly, the Court emphasised that, by being ‘directly displayed in the inbox’ of the recipient, the newsletter qualifies as direct marketing. Therefore, the Court held that a newsletter containing a summary of articles on new legislation, hyperlinks to those articles and to content available for a fee, sent directly to the email inbox of a user constitutes a use of electronic mail ‘for the purposes of direct marketing’ within the meaning of Article 13(1) and (2) Directive 2002/58/EC (e-Privacy Directive). == The Court referred to the Advocate General’s Opinion when discussing the definition of a ‘sale’. It noted that the term covers only transactions involving payment. At the same time, it emphasised that Article 13(2) e-Privacy Directive does not distinguish between the type of services provided. Therefore, the Court applied the reasoning for the concept of services under Directive 2000/31 to the interpretation of Article 13(2) e-Privacy Directive. Specifically, the Court reiterated that remuneration of a service does not require that payment is made by those for whom the service is performed. Thus, the Court held that the cost of advertising paid content through the newsletter is included in the price of that content, meeting the requirement of payment and falling within the concept of ‘a sale of … a service’ under Article 13(2) e-Privacy Directive. = The Court noted that Article 13(2) e-Privacy Directive imposes specific obligations on the controller for the processing activities carried out on personal data in the context of a communication falling within its scope. At the same time, Article 95 GDPR and recital 173 exclude the application of the Regulation to matters which are already subject to specific obligations under the e-Privacy Directive. Therefore, the Court held that the lawfulness of the processing of personal data in relation to a communication within the scope of Article 13(2) e-Privacy Directive can be established based on that provision without applying the conditions in Article 6(1) GDPR as well. = The Court held that there was no need to give an interpretation to the concept of ‘commercial communication’ since the newsletter falls within the concept of ‘direct marketing’. = The Court held that there was no need to answer point (b) of the fourth question and the fifth question.