Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
55 results · Showing 41–55
Nationale Maatschappij der Belgische Sporen (NMBS)
This ruling of the Belgian court of appeal (Marktenhof) concerns the Belgian Railway company SNCB/NMBS (controller), a company with the Belgian state as its only shareholder. During the COVID-19 Pandemic, the controller was ordered by the Belgian government to start an initiative to promote train travel. On 13 October 2020, the controller emailed railway pass holders to inform them about the use cases of this travel pass and also provided COVID-19 related information. This e-mail resulted in GDPR related discussions on Twitter, specifically regarding the lack of the possibility to object. The Belgian DPA started an investigation on that matter and found that by not providing the possibility to opt-out of receiving similar emails, the controller violated Articles 12(2), 21(2) and 21(4) GDPR. Moreover, the DPA held that the controller violated Article 5(1)(a), 5(1)(c), 5(2), 6(1), 12(2), 21(2) and 21(4) GDPR. The controller was fined €10,000 (a summary of this decision is available on the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_71/2022 hub]) and decided to appeal the decision with the Appeal Court on the following grounds: First, the controller contested the applicability of the GDPR, considering that the e-privacy directive was applicable as lex specialis. Second, the controller stated Article 6 ECFR had been breached because it had not been able to comment on a piece of evidence. Third, the controller stated that the decision of the DPA was based on an inaccurate and incomplete representation of the facts. Among the others, the controller disputed the DPA’s definition of ‘Direct marketing’. It added that it had sent the e-mail in the first place because it was obligated to do so pursuant to the government's instruction. It had to provide COVID-19 related information and promote its full service as part of its public service obligation. Fourth, the controller argued that the DPA did not properly motivate the GDPR violations in the disputed decision. Fifth, the controller disputed the DPA's application of the national implementation of article 83(7) GDPR which enables the DPA to fine a public entity controller under certain conditions. Sixth, the controller stated that the DPA did not properly motivate its fine. First, the court held that both the GDPR and the e-privacy directive were applicable in this case. The court stated that Article 13(2) of the e-privacy directive, which covers the conditions for direct marketing, explicitly mentions that the GDPR should also be respected. Second, the court determined that there was indeed a piece of evidence on which the controller was not able to comment but it was not the main piece of evidence on which the DPA’s decision was based. Third, the court held that since the e-mail also included a hyperlink linking to promotional content, it was a form of direct marketing. The court also agreed with the DPA that promotional material for a government service can constitute direct marketing. Fourth, the court held that the DPA properly motivated the violations in the original decision. Fifth, the court rejected the controller’s argument regarding Article 83(7) GDPR, considering that the controller did not limit itself to its legal obligation by only providing the railway pass and sanitary information regarding COVID-19. Therefore, Article 83(7) GDPR was not applicable for the controller. Sixth, the court held that the DPA did not adequately consider the circumstances brought forward by the controller that could impact the amount of the fine. The court also considered several circumstances on its own initiative, namely that the communication had the main goal of providing safety from COVID-19 infections and the fact that the controller had been obligated by law to issue the travel pass. In conclusion, following point 6 of the appeal above, the court concluded that the fine was improperly motivated, not proportional and reduced it to a symbolic €1,00. It rejected all the other grounds for the appeal and therefore confirmed the original decision on the other grounds.
Verbraucherzentrale NRW e.V., Beratungsstelle Köln
The North Rhine-Westphalia Consumer Center brought an action against Telekom Deutschland GmbH, a German telecommunication company. The legal dispute before the District Court of Cologne concerned several points. First, the Consumer Center questioned the lawfulness of the controller's disclosure of personal financial data to credit ranking agencies, in particular SCHUFA Holding AG and CRIF Bürgel, in the context of the performance of mobile communication contracts. The controller provided these companies with personal data of its costumers in order to check their creditworthiness and prevent fraudolent behaviours. Second, the Comsumer Center doubted that the controller's privacy policy was GDPR compliant. Furthermore, in the opinion of the Consumer Center, the controller did not validly collect consent for the use of cookies on its website but rather relied on dark patterns in the cookie banners, that inevitably misled users. Finally, the transfers of customers' personal data to third countries - including the US - for analysis and marketing purposes violated GDPR. The Consumer Center claimed that when customers visited the controller's website, personal data like IP address and information about browser and device used by the visitor were transmitted to Google LLC. Therefore, the Consumer Center requested the court to order the controller: a) to refrain from transferring personal data to credit agencies, in particular SCHUFA Holding AG and CRIF Bürgel, when carrying out and/or executing mobile communication contracts. b) To refrain from using the privacy policy with regard to existing mobile communication contracts with consumers and from relying on such clauses for any future contracts. c) To bring the cookie banner design in compliance with the GDPR, especially by embedding an easy option not only to consent to cookies, but also to refuse them. d) To refrain from transferring personal data of consumers to third countries for advertising and marketing analysis purposes. The court held that the Consumer Center's request to order the controller not to transfer financial data to credit agencies was unfounded. According to the court, such a request for injunction was too broad. It is true that the disclosure in the past was unlawful, as the controller's legitimate interest to fight fraudolent behaviours could not override the data subjects' fundamental rights. However, a broad prohibition would inevitably affect future processing activities that may be effectively covered by the controller's legitimate interest. Furthermore, the court held that the privacy policy did not violate the GDPR. In its privacy policy the controller simply informed consumers about data transfers to third parties and countries, without any further legal effect. This document did not constitute a legally binding contract offered to customers by the controller, as the Consumer Center suggested. The court also held that the Consumer Center's claim with regard to the cookie banners was unfounded. On the outset, the court highlighted that according to Article 4(11) GDPR, consent shall be freely given, specific to the purposes, informed and unambiguous. At the same time, the court pointed out that the request was too broad and did not reflect the requirements established by the GDPR. According to the court, it was not possible to order the controller to implement a specific design for the cookie banner. With regard to data transfers to the US, the court upheld the Consumer Center's view. The court held that transfer of users' personal data to Google's servers in the US was not in compliance with Articles 44 and following GDPR. The court refered to the CJEU ruling in the Schrems II case, in which the CJEU invalidated the Commission's adequacy decision pursuant to Article 45 GDPR. Moreover, the court highlighted that in the present case it was not possible to rely on standard contractual clauses pursuant to Article 46(2)(c) GDPR either, as these were not able to ensure an adequate level of protection. Finally, the court ruled out the possibility that users' consent via a simple "accept all" button in the cookie banner could be interpreted as data subjects' explicit consent to the transfer of their personal data to third countries. As a matter of fact, the controller did not even mention Google as a recipient of data transfers to the US. Consequently, derogation under Article 49(1)(a) GDPR did not cover the processing at issue. In light of the above, the court held that data transfer to Google's servers in the US was unlawful and ordered the controller to stop the processing.
Data Privacy Stichting
This case concerns a class action filed by the Data Privacy Foundation, an organisations which pursues redress on behalf of victims of privacy intrusions in the Netherlands, against social media company Meta. The complaint filed by the foundation was directed at unlawful personal data processing practices by Meta, through their Facebook service. The three defendants in the lawsuit were three companies of the Meta group (Meta Platforms Inc; Meta Platforms Ireland Limited; and Facebook Netherlands BV). The complaint filed by the Foundation consists of four main issues. Firstly, the claim submitted that Meta infringed their transparency obligations in Articles 5, 12, 13 and 14 GDPR by failing to sufficiently inform users of a number of processing operations. Secondly, the Foundation submitted that Meta processed personal data in lack of a legal basis in violation of Article 6 GDPR. Thirdly, it was claimed that Meta unlawfully processed special categories of personal data (Article 9 GDPR). Fourth, and finally, Meta did not obtain valid consent for the use of cookies, tracking of surfing behavior, and app use outside the Facebook service – for advertising purposes – in violation of the Article 11.7a of the Dutch Telecommunications Act. Each of these issues, and the details of the claims made by the Foundation, will be discussed further below. Issue 1 – Transparency obligations The complaint filed by the Foundation detailed a number of ways through which Meta infringed its transparency obligations under the GDPR. Firstly, the controller did not inform data subjects about the disclosure of personal data to external developers who could process personal data for their own purposes. From 2010, Meta (then called "Facebook") introduced an API (Graph API 1.0) to allow other software developers to link their software to the Facebook service. This API makes it possible to exchange data and communicate between different software systems. Prior to the first use, permission was requested from the Facebook user. Subsequently, after obtaining the consent, data from both the Facebook user and friends of the Facebook user were collected by the third-party developer. The most well-known and used application of this API is the login function of the Facebook service, which is used to register with a third party. In 2015, a new version (Graph API 2.0) was introduced in which access to personal data of Facebook friends is no longer offered, subject to a transition period for developers who used the API before 2015. In principle, a forced migration to the 2.0 version applied after the transition period, but documents showed so-called 'whitelisted developers' could still use the 1.0 version after the transition period and could therefore still process data from Facebook friends. The foundation claimed that, throughout this period Meta did not, or at least did not clearly, inform the data subjects about such access granted to third party developers. Secondly, it was alleged that Meta did not inform the data subjects about the disclosure of personal data to third parties who subsequently disclosed personal data to other parties; in particular, these are the circumstances which led to the notorious Cambridge Analytica scandal. Thirdly, Facebook users had the option to secure their account by means of two-factor authentication, by providing their telephone number and receiving a login code. Facebook was accused of using these telephone numbers to send users personalised advertisements, without informing them in a clear and timely manner. Fourth, and finally, it was submitted that Meta did not provide sufficient information about the sharing of data with third parties as part of the “integration partnership program”. Meta had entered into a collaboration with integration partners in the past, with the aim of giving Facebook users access to the service on different devices, because there were no uniform applications available in the App store and Google Play store at that time. Through collaboration with external developers, an API was introduced to enable the partners to develop applications and functionalities for the Facebook service. Via this API, the partners also gained access to the personal data of the Facebook users and their friends. Issue 2 - Processing of personal data without a valid legal basis With regard to the processing of personal data for advertising purposes, the Foundation noted that Meta did not have a legal basis to carry out this processing. This case concerns processing which took place between 2010 and 2020, as the GDPR did not enter into force until 25 May 2018. A distinction must be made between the lawful basis for processing before and after this date. Before 25 May 2018, the relevant European legislation was the Data Protection Directive, implemented in Dutch domestic law through the Personal Data Protection Act WBP. Meta claimed that, during the former period, it relied on consent, contractual necessity and legitimate interest to process personal data for advertising purposes. After 2018, Facebook Ireland Ltd generally based such processing on contractual necessity (Article 6(1)(b)) and for some specific situations on consent (Article 6(1)(a)). Meta’s argument for using "contractual necessity" as a lawful basis was based on the assertion that the Facebook service is essentially a personalized service, which includes, as a core function, the provision of personalised content and advertisements. Meta also claimed that this was made clear by the Terms of Use. On the contrary, the Foundation argued that the personalisation of advertisements is not the reason why users signed up for the Facebook service. Furthermore, it cannot be argued that the core of the contract between users and Meta is personalized advertising, as it is clearly a social network. Issue 3 – Processing of special categories of personal data The Foundation claims that Facebook Ireland Ltd has violated Article 9 GDPR by processing special categories of personal data for advertising purposes outside the scope of the exemptions provided for in Article 9(2) GDPR. For example, a report of the Dutch DPA stated that in the period from 2012 to 2017, advertisers were offered the opportunity to select interests based on, among other things, "health", "Islam" and "pregnancy". Facebook refuted these accusations by stating that they only analysed the 'likes' of users and kept track of which advertisements the user clicked on. In their view, the categorisation as a result of this analysis did not constitute processing of special categories of personal data. In addition, Facebook stated that the categorisation associated with a particular profile cannot in any way guarantee that this information is correct. For example, someone who likes a page about pregnancy is not necessarily pregnant, so there can only be an indirect connection between the interest and the special personal data. Issue 4 – Cookie tracking and use of location data Finally, the Foundation claimed that Meta used third-party cookies to compile a profile based on users' surfing behavior in order to offer targeted advertisements. According to the Dutch legislation (Art. 11.7a of the Dutch law implementing the e-Privacy Directive), before one wishes to access information or to store information in a user's peripheral equipment, one must (i) clearly and completely inform the data subject; and (ii) obtain the consent of the user. The Foundation argued that Meta did not comply with its information obligations and the requirement to obtain valid consent. In response, Meta cited the Fashion ID judgment of the CJEU to defend the position that it is not obliged to comply with the requirements of Article 11.7a of the Dutch Law if it receives personal data via cookies on third-party websites, and that this obligation is applies to the operator/manager of the third party website. Firstly, regarding the initial issue of whether the foundation has a sufficient interest to bring the claim. Meta had argued that the case should be rejected due to 'absence of sufficient interest' on the part of the Foundation. According to Meta, the Foundation only invokes an alleged loss of control over personal data without making it clear why this could cause legal damage. However, a single infringement of a privacy right does not in itself lead to damage. Addressing this question, the court stated that, in principle, a sufficient interest is to be presumed and the court would be reluctant to rule that a sufficient interest does not exist. Accordingly, the court held that, in light of Article 6:106 of the Dutch Civil Code, if it is plausible that liability exists for damages or that unlawful action has been taken, then the court must assume that the plaintiff has an interest in bringing the claim. As a result, it was found that the Foundation has such a sufficient interest. The court then issued its judgement regarding each of the four issues which are central to this case. The fundamental assumption underlying the court's decision is that Meta, as the entity determining purposes and means of the processing, was the controller. Issue 1 – Transparency obligations With regards to the first claim made by the foundation (failure to inform data subjects of disclosure to third party developers) the court observed that Meta could not delegate or transfer their obligations of transparency to third-party developers. As a matter of fact, Meta installed a pop-up window for the purposes of providing information to data subjects. This pop up window was sufficient in informing data subjects that personal data was being shared with third party developers. However, Meta had not sufficiently informed data subjects as to the purposes of the processing. Furthermore, users were not sufficiently informed, when registering from an account, that external developers would be able to access their personal data when one of their friends downloaded a third party application. With regards to the second question, the court held that the transfer of personal data to Cambridge Analytica was not relevant for the assessment in these proceedings, since Meta had no influence or control in granting Cambridge Analytica access to the personal data. Meta was therefore not a data controller in the context of this processing. As for the third point (use of telephone numbers for personalised advertising) the court held that, as there was no legal basis for the processing of personal data including telephone numbers (see below), the Foundation no longer had an independent interest in a declaratory judgement concerning whether or not Facebook fulfilled its obligation to provide information in this regard. This question was therefore no longer relevant. Concerning the fourth point (insufficient information about the integration partnership program), the court stated first and foremost that granting access to personal data of Facebook users can be regarded as relevant data processing for which Meta was responsible. As a result, the information obligation rested on it as data controller. Moreover, in the absence of any evidence to the contrary, the court concluded that, at the relevant time, Facebook users were not informed at all about this data processing. Issue 2 – Processing of personal data without a valid legal basis Regarding the legal basis for processing (Article 6 GDPR) the court held that Meta could not rely on any of the alternatives it put forward for the processing of personal data for advertising purposes. Addressing the “contractual necessity” argument, the court clarified that in the context of a contractual online service, the specific purpose is decisive. In this regard, in order to prove that the processing is necessary in this way, the controller must demonstrate that the main object of the contract cannot take effect if the specific processing of the personal data does not take place. The court held that the most essential feature of the agreement consists in offering a profile on a social network; and that behavioral advertising is subordinate to this. The core function of the contract was therefore providing a social media service, not advertising, and the processing in question could not be considered necessary for the performance of this contract. In addition, the EDPB guidelines on the provision of online services state as a general rule that the processing of personal data based on browsing behavior is not necessary for the performance of a contract for online services. The court concluded that during the part of the period that the GDPR applied, there was no legal basis for the processing of personal data for advertising purposes. Regarding consent, the court stated that none of the methods used on the Facebook service resulted in a consent validly given. There was not a specific, informed and unambiguous expression of will for processing for advertising purposes and, as a result, Meta could not claim to rely on consent as a legal basis. Furthermore, legitimate interest was also not recognised by the court as a basis for processing personal data for advertising purposes. The court stated that the CJEU still has to decide if legitimate interest is even a legal basis that can be used for advertising purposes. In any case, although the court confirmed that commercial interests on the part of Meta could in principle constitute a legitimate interest, it noted that Meta did not make a concrete balancing test of interests. In addition, Meta's legitimate interest does not pass the necessity test because the sale of advertisements that are not personalized, or are less personalized, would be sufficient to achieve the goal. Also, it cannot be argued that data subjects, as users of a free service such as Facebook, generally expect that their personal data is being processed and their activities are being closely monitored, resulting in a negative assessment in terms of proportionality and subsidiarity. Issue 3 – Processing of special categories of personal data With regards to the processing of special categories of personal data, the court’s assessment was limited to the period that was subject to the investigation by the Dutch DPA – namely between 2012 and 2017. In order to address the question of whether Meta unlawfully processed special categories of data during that period, the court referred to the judgment of the CJEU of 1 August 2022 (OT/Vtec). In this case, the CJEU found that a higher level of protection applies to special categories of personal data. Meta asserted a distinction between special data that users specifically enter into the website; and data that Meta obtains by deducing certain interests from browsing history. Meta claimed it did not use the former for advertisement, and that the latter cannot be considered special category data. The court did not accept Meta’s arguments in this regard. Firstly, the Dutch DPA investigation found that Meta allowed advertisers to show users personalised adverts based on sexual orientation indicated in their profiles. Secondly, in terms of browsing habits, the court found that this data is cable of revealing special category personal data, in accordance with the high level of protection afforded to such information. Furthermore, the court also referred to the EDPB guidelines on targeting social media users. The classification of users on the basis of religion, philosophical belief or political opinion is considered processing of special categories of personal data, regardless of the accuracy of the classification. In light of all of the above, the court found that Meta unlawfully processed special category personal data, in violation of Article of the Dutch law implementing the Data Protection Directive and Article 9 GDPR. Issue 4 – Cookie Tracking and Use of Location Data With regard to the use of cookies, the court addressed Meta’s argument that the obligation to inform users and obtain consent was not theirs, but it concerned rather the operator of the third party website. The court held that the obligations rest with the legal person responsible for placing data in the peripheral equipment and obtaining access to the information stored in the peripheral equipment. Meta is also responsible in the case of third party cookies. However, it can delegate this to the website administrator via agreement. Therefore, in view of insufficient evidence to the contrary, it could not be established that Meta violated Article 11.7a of the Dutch law implementing the e-Privacy Directive. However, this does not alter the fact that Meta did not have a valid legal basis to process personal data via cookies for advertising purposes (see above). With regard to the location data, the court ruled that, insofar as this data is part of the data of which the processing has not been sufficiently communicated or for which no legal basis has been demonstrated (see above), the above judgments also apply to this data. Summary Overall, the court held that Meta had violated Articles 5(1)(a) and 6(1) GDPR by processing personal data for advertisement without a legal basis. Meta also violated Article 9(1) GDPR by unlawfully processing special category data for advertisement. Finally, Meta violated its transparency obligations in accordance with Article 13 GDPR. In addition, the controller was ordered to pay the costs of the proceedings. It has to be stressed that the decision adopted by the court is just a declaratory judgement, which means that the questions concerning the existence and the amount of damages and the related right to compensation remained open.
SA Rossel et Cie
This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation on their cookies practices (see [https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-22-februari-2023-van-het-marktenhof-ar-953-beschikbaar-in-het-frans.pdf here] for the DPA decision and here for the GDPRhub summary). The Belgian law empowers the board management of the DPA to issue a referral in order to open an ex officio investigation (Article 63(1) of the Law establishing the Belgian DPA). This referral needs to indicate that there are "serious indications of a practice that could give rise to an infringement of the fundamental principles of personal data protection. In this case, the board management issued a referral on 16 January 2019 without mentioning any reference to serious indications of potential infringements, or any evidence for that matter. The investigation was however considered open on that date. On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) containing several reasons for starting the investigation, among others the high amount of visitors of the controller's websites. On 16 June 2022, the DPA issued decision 103/2022, fining the controller for several GDPR related violations. The controller appealed this decision at the Market Court in Brussels, stating that the DPA's board management referral did not indicate the reasons to investigate. It was thus irregular, and implied that the investigation service was irregularly seized. As a result, the DPA decision was also invalid. The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be considered as (a part of) the referral, and was therefore not an administrative act. The court then assessed if the referral was compliant with the requirement of motivation of administrative acts. Specifically, this motivation requirement would obligate the DPA to properly explain the presence of serious evidence, pursuant to Article 63(1) LCA. The court concluded that the referral itself did in contain any specific arguments for the existence of serious evidence. The court stated that this irregularity of the referral led to the irregularity of decision 103/2022. It therefore annulled the DPA decision and ordered the DPA to pay the costs of the proceedings.
Court case 10 O 14/21
The controller operates several websites. The data subject stated that, as a consumer, he ordered household goods from the controller's online shop in 2020, giving his name and address. According to the data subject, the controller violated data protection law in several ways. He stated that the controller had deliberately integrated malware into its site, which manipulated the data subject's internet browser. Thereby, personal data had been unlawfully processed by the controller itself, as well as being irrevocably forwarded to foreign third party companies in order to track his online behaviour by setting cookies without his consent. Due to the alleged violations, the data subject claimed to be entitled to injunctive relief for infringement of Article 6(1) GDPR. Furthermore, he argued the infringement of Article 26 GDPR (joint responsibility) and Article 44 GDPR (third country transfer). The controller argued that the data subject had not sufficiently substantiated his claim since he had neither specified the processing of his data that allegedly took place nor described it accurately. Moreover, according to the controller, there is no basis for a claim because the GDPR does not provide for injunctive relief under civil law. The Regional Court Wiesbaden found the data subject's action both inadmissible and unfounded. First, the court stated that the data subject's claim was not sufficiently specific as it did not specify what exact behaviour he wanted to prevent with the injunction. Then, the court added that the lack of specification of the exact data processing activity also made the claim unfounded as the data subject had not even given information on what and when he ordered in what specific online shop of the controller. To the court it was clear that the data subject was not concerned with being affected in a specific case where he saw his personal rights violated, but rather a fundamental abstract clarification. There had been no pre-judicial correspondence in the case at hand, which would have been required in order for the controller to be able to defend itself. Finally, the court agreed with the controller that the GDPR does not provide for injunctive relief under civil law. According to the court, there was no basis for the claim under Article 6 GDPR and Article 44 GDPR. It held that for a civil law claim, it is in not sufficient that there are regulations in the sense of permission or prohibition norms, but that there must be a norm that formulates a subjective claim for the individual and can thus be used as a basis for asserting a claim. Article 17 GDPR, which would give the data subject individual rights, was not applicable as it did not match the data subject's objective. While § 1004 BGB generally allows for injunctive relief, the court did not see any room for application because the cases for claims under the GDPR are exhaustive.
Court case Tussenarrest 2022/AR/292
The Belgian 'Gegevensbeschermingsauthoriteit' (DPA) received multiple complaints against IAB, a digital advertising company (alleged controller). The complaints concerned the ‘Transparency and Consent Framework (TCF), which was developed by the alleged controller. TCF is a standard technical framework that enables websites, advertisers and ad-agencies to obtain, record, and update consumer consent, objections and preferences for web pages. TCF was meant to help companies to become more GDPR compliant. Also, TCF makes it overall easier to record preferences of data subject for companies that use the so called ‘consent management platform’ (CMP), which is an interface that appears when a data subject first navigates to a websites or uses an application for the first time. Here, a data subject can give consent for the collecting and/or sharing of personal data or object to the processing of his/her data. These preferences are then saved and encoded in a ‘TC-string,’ which can be shared with other companies. The CMP also places a cookie on the device of the data subject in question. The TC string and this cookie could also be coupled with the IP-address of the data subject. Following the several complaints, the DPA started an investigation into IAB. After the DPA finished its investigation, it fined the alleged controller €250,000. In its decision, the DPA held amongst other things that IAB was the controller with regard to the processing of the registration of consent and objection of data subjects in the TC-string. The DPA also held that the alleged controller had to bring its processing activities in compliance with the GDPR. It had to provide a legal ground for processing in the context of TCF. It also needed to restrict its customers from using an opt-in consent in the CMP-interface, where data subjects would consent to legitimate interest (Article 6(1)(f) GDPR) as a legal basis. In addition, the alleged controller had to implement appropriate technical and organizational measures to guarantee the integrity and confidentiality of a TC-string and had to check its customers taking part in TCF if they were GDPR compliant. The alleged controller appealed the DPA’s decision at the Belgian Court of Appeal. It requested the Court to overturn the previous decision on various grounds. It held amongst other things that it wasn’t the (joint) controller for processing operations with the TC-string. It also stated that it didn’t process personal data in the first place. During this appeal, the complainants voluntarily joined the proceedings with their own requests, primarily supporting the DPA in its arguments. The main request of the complainants entailed the referral of questions to the European Court of Justice (CJEU). These were in essence the following: Question 1: Is the TC-String (with or without a combination with an IP-address) personal data for the controller? Is a TC-String personal data? And in combination with an IP-address? Question 2: Is IAB a (joint) controller? The Court suspended the case and referred the following questions to the CJEU: 1) Is the TC-string personal data (with or without a combination with an IP-address) for the alleged controller and/or with regard to companies that use the TC-string? (Article 4(1) GDPR) 2) a) Is IAB a (joint) controller (Article 4(7) GDPR and Article 24(1) GDPR)? b) Does it matter whether or not IAB has access to the personal data which is processed by companies that use the standards of IAB? c) If IAB is indeed a (joint) controller, does this also entail responsibility for further processing by third parties regarding the preferences of data subjects, such as targeted online advertising?
RheinMain University of Applied Sciences
Controller is the RhineMain University of Applied Sciences. On its website (https://www.hs-rm.de), it used the consent manager “Cookiebot” to obtain users' consent to the use of cookies, and the "Google Tag Manager". Data subject regularly visits the website to look for specialist literature in their online catalogue, and found that their IP address is automatically transmitted to Google’s server each time they visit the website, without having given consent. In addition to their IP address, all kinds of information on the hardware and software of the user’s terminal device is sent, i.e., the accessed’ website, their operating system and its version, the browser and its version, the screen resolution etc. Moreover, Cookiebot is a service offered by the Danish provider Cybot. Although the company is established in Denmark, the target domain “consent.cookiebot.com” refers to a server with an IP address registered with the US-based cloud company Akamai Technologies Inc. (hereafter: Akamai). Although the server might be located in the EU, the cloud company has access to the data on this server. Therefore, the US Cloud Act applies, which means that US governmental agencies can request access to this data, without a court order or mutual legal assistance agreement. After the data subject had written three warning letters to the controller, the latter responded on 7 June 2021 that it no longer used the Google Tag Manager, but refused to submit the obligation to cease and desist regarding Cookiebot. Hence, on 8 June 2021, the data subject applied for interim relief. The Court upheld the appeal and ordered controller to terminate the integration of Cookiebot for the purpose of obtaining consent on its website, since the transmission of personal data is unlawful. First, it noted that the data subject could invoke the right to effective judicial remedy, pursuant to Article 79 GDPR, and that this provision does not have a blocking effect for further judicial remedies. Second, the Court confirmed that the conditions of the right to injunctive relief have been fulfilled. It considered that the controller processes the unabridged IP-address of data subject, after which the company behind “Cookiebot”, Cybot, also processes this IP-address. Although the controller claimed that this was an anonymised version of the IP-address, it follows from the information provided by Cybot that this is not the case. Moreover, the Court noted, referring to Breyer (Case C-582/14), that an IP address is personal data. Because Cybot uses the processing services of Akamai by storing their data on its servers, a data transfer to a third country, namely the USA, takes place. The Court acknowledged that the data might be stored on the servers of the European affiliate of Akamai, namely A Technologies GmbH. However, according to the Court, this was irrelevant since the company's headquarters are located in Cambridge, Massachusetts, USA. Then, the Court stated that this transfer is inadmissible according to Article 48, and Article 49 GDPR. Because Akamai is an American company, it is subject to the US Cloud Act, and therefore obliged to disclose all data in their possession. There is no international agreement between the EU and USA to serve as a legal basis, so Article 48 GDPR does not apply. Moreover, the Court considered that none of the conditions referred to in Article 49(1) and Article 49(2) GDPR is fulfilled, so this provision does also not apply. Lastly, the Court stipulated that the controller is responsible for the data transfer, pursuant to Article 24, in conjunction with Article 4(7) GDPR, although the controller does not transmit the data itself. The Court concluded that, because the controller embedded Cookiebot on its website, it indirectly decided on the purposes of the processing.
DSB (Austria)
The data subject called the helpline of the Österreichsiche Post AG (Austrian Postal PLC). He gave his phone number to the employee with the request for a callback, thereby stating that he did not want the phone number be given to a third party. Afterwards the data subject was called twice by a market research institute – the processor. The controller and the processor had concluded a processing-contract under Article 28 GDPR. The data subject filed a complaint with the DSB (Austria) arguing that the transmission of his data (name and phone number) to the processor was illegitimate since he had already denied consent to any form of data sharing with a third party. During these proceedings the data subject amended their submission by also tackling the use of cookies by the controller. The DSB dismissed the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court determined that the processor is to be seen as a dependent extension of the controller (“verlängerter Arm”) (cmp. Article 29 GDPR). If the processing of data is in accordance with Article 6 GDPR, the controller is free to deploy a processor. As a result, the transmission of data from the controller to the processor itself does not need to be justified under Article 6 GDPR. In the case at hand, the court came to the conclusion that the processing of data by the controller - and therefore also the transmission to the processor - is justified under Article 6(1)(c) GDPR. The controller in this case - the Österreichsiche Post AG - is obliged under national law (§§ 6(8), 32(3) PMG) to provide for a complaint management system to improve their services. According to § 6(8) PMG a postal service must further develop its service in accordance with the needs of users and to contribute to securing the provision of postal services and to the further development of them by means of appropriate measures and proposals. Pursuant to § 32(3) PMG postal service providers must have a complaints management system in place so that users can raise disputes or complaints. Besides, the court decided the amendment of the data subject’s complaint was inadmissible pursuant to § 13(8) AVG and a data subject has no subjective right to the initiation of administrative fine proceedings under the GDPR and according to § 25(1) VStG.
Court case HFD:2021:125
The Regional Government of Åland had appointed Mr A as head of the regional Ålandic DPA for a probationary period of one year. Pursuant to section 10(2) of the Act on Public Officials in the Region of Åland, the Government of Åland stated that they would not propose the appointment of A to a permanent post and that A's term of office would therefore automatically come to and end after the one-year probationary period. At the end of the probationary period, the Government of Åland issued a notice confirming that Mr A's term of office had ended. Mr A however applied to the Supreme Administrative Court of Finland for the annulment of this decision, which he considered contrary to the GDPR. The Supreme Administrative Court considered that the notice issued by the Government of Åland constituted an administrative decision terminating Mr A's mandate. The Supreme Administrative Court found that, in addition to national legislation, A's role as head of the data protection authority is also regulated by EU law, and in particular by the GDPR. Although the GDPR does not contain explicit provisions regarding probationary period, the minimum length of the term of any member of any data protection authority is "no less than four years", as set in Article 54(1)(d) GDPR. As a consequence, the termination of A's mandate at the end of the probationary period could not be considered in line with the GDPR. The Supreme Administrative Court further noted that leaving Mr A without any possibility of appeal against that decision would be contrary to the right to a fair trial as protected under the Finnish Constitution, Article 19 TFEU and Article 47 CFR. As Mr A's mandate and termination had not been assessed in the light of the provisions of the GDPR, the Supreme Administrative Court concluded that the decision to terminate Mr A's mandate had to be annulled and the matter referred back to the Government of Åland for reconsideration.
Court case 2 C 133/21
The case focused on unauthorized marketing emails and lack of consent, unrelated to cookie or consent banner issues.
Facebook Ireland
In the proceedings, the plaintiff filed a total of 12 applications. The court ruled on 6 of these applications by partial judgment of 23 June 2021. The proceedings were interrupted with regard to the remaining 5 applications until the CJEU has ruled on the preliminary ruling proceedings initiated by order of 23 June 2021. An overall short summary can be found [https://noyb.eu/en/breaking-austrian-ogh-asks-cjeu-if-facebook-undermines-gdpr-2018 here]. This partial judgment only concerns applications 1 - 4 as well as 11 and 12, so that only the relevant facts are reproduced in abbreviated form below. The facts relevant for the remaining interrupted proceedings, for which the preliminary ruling procedure has been initiated at the CJEU, are presented there. The plaintiff is Max Schrems. The defendant is Facebook Ireland. The court first explains how Facebook works. These findings are only presented in a roughly abbreviated form in the following: Facebook provides a platform on which more than 2.2 billion users worldwide can upload data and respond to data uploaded by other users. This includes text contributions, pictures, videos, events, comments, "likes", markings on photos and much more. In addition, users network with each other in so-called "friendships". Facebook itself does not generate any content itself and only provides the infrastructure (free of charge). Facebook receives the (linked) personal data. The economic model of the defendant is to generate revenue through personalised advertising and commercial content based on preferences and interests of users. The plaintiff has been using his Facebook account for private purposes since 8 June 2008. In doing so, he decides himself with whom he is in contact, whether and to whom he sends messages, what information he enters in his profile, etc. The plaintiff's Facebook friends also regularly save posts by the plaintiff or about the plaintiff. The first four applications dealt with the "division of roles under data protection law" between Facebook and the plaintiff. Among other things, the plaintiff took the position that he was both the data subject and the data controller for the information he provided, while Facebook was only a processor in this respect. With application 11), the plaintiff asserted a right of access. In application 12), the plaintiff sought non-material damages for breach of the duty to provide access in the amount of €500. The plaintiff still has no conclusive overview of the actual extent of his data used. In addition, he was unsolicited invited to events for homosexuals on Facebook. The court of first instance granted the applications for 11) and 12). The remaining applications were rejected. It first found that the plaintiff had actively or passively accepted all terms of use before and after the introduction of the GDPR - whereby his account had been blocked in the meantime for lack of consent - as well as any updates. It also stated that there was no realistic possibility for the plaintiff to circumvent Facebook's services (400 Facebook friends, some of whom only use Facebook and some of whom only provide certain information there). Facebook has set up tools to give users insight into and control over their stored data. Not all processed data can be seen in these tools, but only those that Facebook considers interesting and relevant for the users. A first tool was introduced in 2010. With the entry into force of the GDPR, a new tool was introduced. Subsequently, the court describes all access tools: "AYI tool - Access Your Information Tool", "DYI tool - Download Your Information Tool" and others. The "Your Off-Facebook Activity" tool, for example, lists partners to whom data about users has been transmitted by Facebook, but not what the data is. Finally, various data setting options are explained. Furthermore, the court states that Facebook uses cookies, social plugins and pixels. Roughly summarised, these tools enable Facebook to collect information about internet users who use external sites, even if they are not Facebook users themselves - and do not use the social plugins, for example. The plaintiff filed a request for information against Facebook in 2011, 2012, 2013, 2015 and 2019. He initially received a PDF file of 18 pages after extensive email correspondence. After further interventions, the parent company of Facebook Ireland sent a CD-ROM with a further PDF file of 1,222 A4 pages in July 2011. In its tools, Facebook only makes available the data that it considers relevant and interesting for the user. In the download tool, one sees much less data than via the developer interface API. The court explains in detail how the information provided by Facebook does not cover all necessary information. For example, Facebook did not provide the plaintiff with individual information on the purpose, source and concrete use of his data. The plaintiff is "massively annoyed" by the defendant's data processing, but not psychologically impaired. There is data stored and processed about him by the defendant over which he has no control because it is not displayed in the tools. The court of appeal confirmed the principle of the judgement of the court of first instance. The court rejected the applications 1 to 4 and confirmed the judgements regarding applications 11 and 12. = The OGH first states that the household exception under Article 2(2)(c) GDPR applies to non-public Facebook pages. Therefore, the first four requests of the plaintiff were rejected, which in particular dealt with the relationship between the plaintiff and the defendant under data protection law (controller, processor). In principle, the application presupposes the exercise of a "private" or "family" (note difference to other GDPR versions where it says “household”) activity. Recital 18 GDPR explicitly mentions the use of social networks and online activities in the context of such activities. The provision aims to avoid unnecessary burdens for individuals. The state's regulatory power should end where data is processed in a private context and thus in the exercise of the general right of personality. The wording "exclusively" shows that mixed use, i.e. private and professional, is covered by the GDPR. Preceding this, the court states that the use of social networks only falls under the household exception if it is restricted to a certain group of users. This does not apply as soon as data is made publicly accessible online. The online posting of a private family tree is mentioned as an example (decision of the OGH 6 Ob 131/18k). In this respect, the household exception does not apply to public Facebook pages. This interpretation also corresponds to the CJEU case law on the household exception under the old Directive 95/46/EC. The legislative history of the GDPR also supports this interpretation. The European Parliament wanted to clarify that the household exception only applies if the circle of recipients is likely to be limited. Even if this ultimately did not become part of the text of the regulation, the intention of the legislator is nevertheless clear. = In an obiter dictum, the Supreme Court further commented on the "distribution of roles under data protection law" between the parties. The Supreme Court ruled that the plaintiff was the data subject and Facebook the controller. A deviating opinion of the plaintiff was rejected. The plaintiff argued that, with respect to his own data uploaded to Facebook, he was both the controller and the data subject. When he processed third party data (e.g. by posting a photo in which a third party could be seen), he was only a controller. In both cases, Facebook was only a processor. The court first addresses a literature opinion according to which such a constellation is possible in principle, at least according to the wording of the legal definition of controller. The data controller could entrust data to a third party for processing. This third party could possibly be obliged to comply with the GDPR provisions as a processor, while the controller could invoke the exemption of Article 2(2)(c) GDPR. The court then refers to the CJEU decisions on publicly accessible Facebook fan pages to determine the concept of a person responsible. In C-210/16, the CJEU had classified the operators of such fan pages as controllers. This was primarily justified by the fact that the operator of a fan page allows Facebook to place cookies on the devices of persons visiting the fan page, regardless of whether that person has a Facebook account. With similar reasoning, the CJEU ruled that the operator of a website who integrates a so-called Facebook Like button into his website is a controller. After all, the integration of the button allows Facebook to obtain data of website visitors, regardless of whether the button is pressed or the visitor has a Facebook account. The OGH concludes from this that the mere use of a social network such as Facebook does not in itself make the user a controller. This is ultimately justified by the fact that the general user of Facebook does not enable Facebook to obtain not inconsiderable amounts of user data. The court also argues that otherwise every user of Facebook would be the controller and this would not be compatible with the intention of the GDPR. = In order to delimit the obligation to provide access, the court first refers to Recital 63 GDPR, which reads as follows: “A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing.” According to the case law of the CJEU, it is sufficient if the applicant receives a complete overview of these data in an understandable form, i.e. in a form that enables them to become aware of these data and to check whether they are correct and processed in accordance with the GDPR, so that they can exercise their rights if necessary. This decision was issued under the old Directive 95/46/EC, but is fully transferable to the GDPR. Facebook had initially provided the plaintiff with a PDF file and a CD with further PDF files amounting to 1,222 pages in 2011 and later referred to the information tools that had been introduced in the meantime. Initially, Facebook had only provided information on the data that it itself considered "relevant". This is obviously not sufficient. The court explicitly states that it does not require further elaboration that the duty to provide information cannot depend on Facebook's mere self-assessment. The information on the online tools also does not meet the requirements of Article 15 GDPR. There, at least 60 data categories with hundreds, if not thousands of data points are available for the plaintiff to download, which would require several hours of work to search through. Thus, the plaintiff cannot obtain complete information. The plaintiff correctly pointed out that the GDPR assumes a one-time request for access, not an "Easter egg search". Another violation is that not all purposes of processing have been disclosed. Facebook's claim that sharing information could infringe the rights of third parties is not valid for two reasons. First, Facebook has not shown what specific rights would be involved. Secondly, it would be up to Facebook to reach agreements with clients who are advertisers so that Facebook can fully comply with its disclosure obligations. Facebook's objection that the scope of the requested information was too large was also rejected. On the one hand, the corresponding case is hardly conceivable with current data. Secondly, it is by no means to be classified as "excessive" if five requests for information are made within nine years. With regard to the question of the extent to which recipients or categories of recipients are to be disclosed, the Supreme Court interrupted the proceedings and referred to a similar preliminary ruling case pending before the CJEU in another case. It had to be decided whether the person responsible had the right to choose whether to present recipients or categories of recipients or whether the data subject could decide on the type of information (6 Ob 159/20f). In this case, Facebook only provided information on categories of recipients. Finally, the court states that the right to information does not extend to data processing in the future. = Finally, the court awarded the plaintiff a claim for compensation for non-material damage due to the breach of the access right under Article 82(1) GDPR in the amount of €500. The court first states that in another case before the Supreme Court, a plaintiff relied exclusively on the "loss of control over personal data" or "processing of political opinions" as such. This was too definite for the Court; it referred the question to the CJEU whether a violation of the provisions of the GDPR as such can give rise to a claim for damages (6 Ob 35/21x). However, this was different in the present case, as the court of first instance had expressly found that the plaintiff was "massively annoyed" by the Facebook's data processing, but not psychologically impaired. The court then states that emotional impairments resulting from the violation of rights, such as fears, stress or states of suffering due to exposure, discrimination or the like, which have occurred or are only threatened, can lead to a claim for damages as immaterial damages. A particularly serious impairment of the emotional world is not required. This is justified solely on the basis of Recital 146 sentence 3 GDPR, according to which the concept of damage is to be interpreted broadly. The Package Travel Directive and the related case law concerning compensation for "loss of holiday enjoyment" do not provide any guidance, according to the court. There, restrictive terms such as "substantial effects" and " substantial problems" are used. The GDPR does not know these restrictions. Rather, non-material disadvantages of rather minor weight were also relevant. Next, the court establishes standards for determining entitlement. On the one hand, according to Recital 146 GDPR ("full and effective compensation"), the damages should not be too limited. Otherwise, the practical effectiveness of Union law would not be ensured. The damages must be appreciable in order to have a preventive and deterrent effect. On the other hand, the effectiveness criterion is only of limited significance, since the GDPR provides for high penalties anyway, so that high damages cannot easily be claimed. Otherwise, there would be a danger of an "effectiveness spiral". The court then states that "massively annoyed" without being psychologically impaired is sufficient for the assumption of non-material damage. Causality already followed from the fact that the plaintiff argued that it bothered him not to have control over the data because they were not displayed in the tools. The use of the word "because" established the necessary connection. For the amount of damage, the court took into account that the plaintiff had no control over his data for a long time
Proximus N.V.
In this case Proximus had failed to grant a woman's right of erasure of her personal data and had passed the data on to other telephone directories and directory enquiry services even after receiving several complaints and correspondence from the data subject. On request of the data subject, Proximus had changed the code linked to the data subject's data from 'visible' to 'confidential'. After adjusting the code regarding publication, Proximus received new contact details of the person concerned from her operator, as a result of which the data in the underlying database was automatically overwritten with the new data from the operator. The Belgian DPA imposed a fine of €20,000 on the defendant defendant for infringement of Articles 6, 7 and 12 of the GDPR. In the contested decision, the Belgian DPA found the infringement of Article 6, 7, 12, 13 and 24 GDPR sufficiently proven. In addition, the DPA ordered the defendant to cease any further disclosure of personal data of subscribers to third parties of telephone directory or inquiry services when Proximus acquired these data only as a provider of telephone directories and directory enquiry services, taking into account a transition period in order to give Proximus (and the telecommunications sector in a broader context) the opportunity to develop a new privacy compliant system. With regard to the question of whether consent is required to be included in telephone directories or not and what scope of this consent is, the Court of Appeal also considered that: 1° In situations where the e-Privacy Directive specifies the rules laid down in the GDPR, these specific provisions of the e-Privacy Directive as lex specialis prevail over the more general provisions of the GDPR. (principle of Lex specialis derogate legi generali) 2° Article 12(1) and recital 38 of the ePrivacy Directive refer to the requirement of informed consent within the meaning of Directive 95/46/EG of subscribers for being included in public directories. Following article 94 GDPR that states that all references to 95/46/EG should be considered as references to GDPR, the abovementioned articles thus refer to ‘consent’ in the light of GDPR and thus the condition for a valid consent (Article 7 GDPR) must be met. 3° This consent relates to the purpose of publication of the personal data in the directories, but not to the identity of the directory provider. Consequently, the court states that the consent given will also be valid for subsequent processing of the personal data by other directory providers, provided that this processing serves the same purpose Given the fact that this is a complex matter which raises some questions that are not yet tackled by the legislator, the Brussels Court of Appeal stayed the proceedings to request the Court of Justice for a preliminary ruling regarding following questions: 1° Should Article 72.2 of the e-Privacy Directive 2002/58/EC, read in conjunction with Article 2(f) of that directive and with Article 95 of the General Data Protection Regulation to be interpreted as allowing a national supervisory to be interpreted as permitting a national supervisory authority to require the 'consent' of a subscriber within the meaning of the General Data Protection Regulation as the basis for the publication of the subscriber's personal data in public directories and directory enquiry services, both those published by the operator itself and by thirdproviders, providers, in the absence of national legislation to the contrary? 2° Should the right of erasure contained in Article 17 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from considering a request by an individual for removalfrom public directories and directory enquiry services as a request for erasure within the meaning of Article 17 of the General Data Protection Regulation? 3° Must Article 24 and Article 5(2) of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from concluding from the accountability obligation contained therein that the controller must take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service provider and, inter alia, providers of telephone directories and directory enquiry services who have received data from that controller, of any withdrawal of consent by the data subject in accordance with Article 6 juncto Article 7 of the Regulation? 4° Must Article 17.2 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from ordering a provider of public directories and directory enquiry services who is requested to cease disclosing data relating to an individual to take reasonable steps to inform search engines of that request for deletion of data?
SERGIC SAS
The case focused on security issues and data retention violations, with no mention of cookies or consent banners.
Claimant: Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv)
The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.) *Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)? *Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR? *Did the defendant violate GDPR provisions on transparency? *Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers? = The court held that the marketing and analytics cookies used by the defendant can only be placed with the users' consent under Article 6(1)(a) GDPR: § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons. Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid. = The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies. = Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google. Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the [https://www.datenschutzkonferenz-online.de/media/dskb/20200526_beschluss_hinweise_zum_einsatz_von_google_analytics.pdf official opinion of the "Datenschutzkonferenz"], a gathering of all German DPAs.
Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e. V.
See facts at the GDPRhub entry to the "Planet 49 case" (C-637/1/). The second checkbox containing a preselected tick used by the defendant (Planet 49) read as follows: {| class="wikitable" !English translation !German original |- |‘I agree to the web analytics service Remintrex being used for me. This has the consequence that, following registration for the lottery, the lottery organiser, [Planet49], sets cookies, which enables Planet49 to evaluate my surfing and use behaviour on websites of advertising partners and thus enables advertising by Remintrex that is based on my interests. I can delete the cookies at any time. You can read more about this here.’ |"Ich bin einverstanden, dass der Webanalysedienst Remintrex bei mir eingesetzt wird. Das hat zur Folge, dass der Gewinnspielveranstalter, [Planet49], nach Registrierung für das Gewinnspiel Cookies setzt, welches Planet49 eine Auswertung meines Surf- und Nutzungsverhaltens auf Websites von Werbepartnern und damit interessengerichtete Werbung durch Remintrex ermöglicht. Die Cookies kann ich jederzeit wieder löschen. Lesen Sie Näheres hier." |} In the explanation linked to the word "here", it was pointed out that the cookies would receive a specific, randomly generated number (ID) associated with the registration data of the user who entered his/her name and address in the web form provided. If the user with the stored ID would visit the website of an advertising partner registered for Remintrex, this visit should be recorded, as well as which product the user is interested in and whether a contract is concluded. Following the CJEU's reasoning in its preliminary ruling, the BGH dismissed the defendants' appeal and, on the plaintiff's appeal, overturned the appellate judgment regarding cookie consent and restored the first instance conviction of the defendant: *The declaration of consent by the preselected tick box does not constitute an "informed indication of the data subject's wishes" within the meaning of Article 2(h) Directive 95/46/EC or an "informed and unambiguous indication of the data subject's wishes" within the meaning of Article 2(h) GDPR. Therefore there is no legally valid consent for the data processing. *The plaintiff is entitled to injunctive relief against the storage of cookies on his device under § 1 UKlaG in connection with § 307 BGB because the request for consent by a preselected tick box constitutes an "unreasonable disadvantage to the user". *The request for consent by a preselected tick box further violates § 15 TMG. An interpretation of § 15 TMG in light of Article 5(3) Directive 2002/58/EC leads to the conclusion that there is no effective consent within the meaning of these provision if the storage of cookies is permitted by a present checkbox which the user must uncheck to refuse consent. *Pursuant to Article 94 and 95 GDPR the above said fully applies also after 25.05.2018.