Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
Court case 490202
In 2021, the Canal+ Group (controller) carried out commercial prospecting by electronic means, targeting approximately 3.9 million people. The controller did not directly seek the consent of the persons concerned. Instead, they contacted people whose personal data and consent for marketing purposes had already been collected by two partner internet service providers (ISPs) through data collection forms. The ISPs' subscribers were invited to check a box to give their consent to the use of their personal data for prospecting purposes by the ISPs’ "partners". The names of these partners were not specified in the form, nor were they accessible via a hyperlink or by any other means. The CNIL (French DPA) conducted multiple inspections. On 12 October 2023, the DPA found that the controller had failed to comply with their obligation to obtain valid consent from the individuals concerned for the purposes of electronic marketing, in violation of Article 7 GDPR. The controller brought an action for annulment of this decision before the Council of State. The Council of State considered that this dispute raised a question as to whether the consent given by the data subject to a first collector, allowing their data to be used by a category of recipients for the purpose of electronic prospecting, can be regarded as informed consent within the meaning of Article 4(11) of the GDPR, read in conjunction with articles 13(1) and 14 of the same Regulation, and article 13 of the Directive of 12 July 2002 on privacy and electronic communications. A further question arises as to whether the degree of specificity of the term « category of recipients » is significant, or whether, as in the present case, it may simply refer to any « partner » of the initial data collector. The Council of State considered that these questions are decisive for the resolution of the dispute and present serious difficulties. The Council of State therefore referred the matter to the Court of Justice of the European Union in accordance with the article 267 of the Treaty on the Functioning of the European Union, and stayed the proceeding on the application filed by Groupe Canal+ until the Court has ruled.
In a combined case, two data subjects sought an order from the Amsterdam District Court for preliminary relief prohibiting LinkedIn (controller) from using tracking cookies on their website. The data subjects claimed that LinkedIn deployed two tracking cookies (li-gc cookie & b cookie) on their devices without having first received consent, as required under both the Dutch implementation of the ePrivacy Directive (Telecommunicatiewet (Tw)) and Article 6(1) GDPR. This action was filed on March 12 2025. In support of their claim, the data subjects relied upon a HAR study (a file within which network traffic is recorded) which allegedly showed that the two cookies in question were deployed before the data subject’s had given consent. Alongside this HAR file, the data subjects also submitted a report by an IT and security specialist who confirmed their claims. These cookies, it was claimed, were tracking cookies used by LinkedIn for their Real Time Bidding (RTB) system which allows for the display of targeted advertisements on their platform. LinkedIn denied the data subject’s claims. In their defense, they argued and both cookies were technically necessary, thus not requiring prior collection of consent under the Tw or the GDPR. They submitted that the li-gc cookie is used to store and retrieve website visitor cookie preferences and the B cookie is deployed to prevent fraudulent traffic and detect abuse on their platform. LinkedIn further argued that, in any event, both data subjects had given consent to the use of non-technically necessary cookies. In support of this, they produced screenshotted proof of the fact that the data subjects had consented to the question “Can LinkedIn and third parties use cookies to deliver relevant advertisements (including jobs) to you on and off our services and to measure the display and effectiveness of the advertisements?”. During the proceedings, the data subjects argued that they were not aware that the provision of consent as formulated above extended to the provision of targeted advertisements. The Court refused the relief sought. The Court found that LinkedIn had convincingly demonstrated that the two data subjects had given their consent to non-technically necessary cookies for the period in question. The Court noted that the data subject’s claims that they were unclear as to the extent of this permission could not be sustained as the consent formulation clearly extended beyond LinkedIn’s own use. In light of this finding, the Court did not deem it necessary to consider whether the cookies in question were technically necessary or not. This decision was thus made without prejudice to that allegation. The data subjects were ordered to pay LinkedIn’s costs.
Court case 10 A 5385/22
The controller is a publishing house that publishes newspapers and content on the Internet at www.noz.de. The controller uses a consent banner (so-called cookie wall) on its website. The defendant is the DPA of Lower Saxony (LfDI). In 15 November 2022, the DPA carried out a technical test on the controller’s website and found that when it was first accessed, without prior consent, the US service Google Tag Manager was contacted meaning that user data were transmitted to Google’s US server and data were stored on the user's device. Also, a consent banner titled "optimal user experience" appeared with the options to "Accept all", in the middle of the banner, or "Accept & close x", at the top right (the x referring to the symbol used to close a window). In order to refuse consent users had to scroll down, select the "Settings" button and at the window opened on a second level, the user must check whether the opt-in controls are switched off in order to then select the "Save selection" button. On 23 November 2022, the DPA issued a decision ordering the controller; a. To implement the requirements for effective consent in accordance with Article 4(11) and Article 7 GDPR, insofar as this is necessary for the lawfulness of the use of local storage objects, tracking technologies and third-party services; b. To obtain effective consent for the Google Tag Manager service integrated in the website in accordance with Section 25 (1) of the german Telecommunications-Digital Services Data Protection Act (TTDSG) and Art. 6(1) (a) GDPR or to remove the service; and c. To comply with the orders within 1 month. The DPA argued that the consent was not fully informed and voluntary in accordance with Article 4(11) GDPR. At the first level of the banner there was no literal mention that the buttons "Accept all" and "Accept & close x" provide two options for granting consent and also there was no option to refuse consent. On December 2022, the controller filed a case before Administrative Court of Hanover (Verwaltungsgericht Hannover - VG Hannover) requesting the annulment of the DPA’s order. They argued that the DPA is not responsible for issuing such order, that the controller does not process any personal data, that user’s consent was obtained lawfully and that they process the data to fulfill a legal obligation pursuant to Article 6(1)(c) GDPR. The DPA responded that the legal basis for the order can be found in Article 58(2)(d) GDPR and § 20 para. 1 of the Lower Saxony Data Protection Act (NDSG). First, the court held that the controller processes personal data within the meaning of Article 4(1) GDPR. Cookies stored on end devices that contain IP addresses and individual user’s IDs, as online identifiers, are considered personal data. Second, the court found that the order under point (a) is materially lawful. The use of cookies and other technologies on the controller's website violates Section 25(1) TTDSG and Article 6(1) GDPR. The setting of these cookies to user’s devices requires effective consent that meets the requirements of Article 4(11) GDPR. The controller’s cookie banner does not meet these requirements because; 1. At the first level the number of the third-party service providers is missing. 2. At the first level the user must scroll down in order to reach the Settings button that gives the possibility to withdraw consent. 3. The overall view of the design of the various levels of the consent banner shows that users are to be specifically directed towards a declaration of consent and their right to choose is to be influenced. 4. The "Accept & close x" button at the top right, is considered non-transparent and surprising design and cannot be assumed that a legally relevant, conscious consent is given. 5. There was no literal mention of “consent”. Furthermore, the processing of personal data by the controller is not carried out to fulfill a legal obligation. Third, it held that the order under point (b) is also lawful. The controller is in breach of Section 25 (1) TTDSG and Article 6(1) GDPR for using the Google Tag Manager service itself without obtaining prior consent from users and that this data processing is also not justified under any legal basis Article 6(1) GDPR. c. Fourth, the order under point (c) is also lawful under Article 58(2)(d) GDPR. Lastly, the court decided that the case is unfounded.
LinkedIn and associated companies placed cookies on users' devices without obtaining prior consent, violating a cease and desist order.
Court case 6 C 3.23
The controller purchases dental gold from dental practices. To do so, it collects the practice owner's first and last name, as well as the practice address and telephone number, from publicly accessible directories, such as the Yellow Pages. The controller uses the contact details stored in a database to contact the dental practices by telephone with the aim of determining whether the parties contacted are interested in selling precious metals to the controller. Following a dentist's report, the DPA ordered the controller to cease the collection, processing, and use of personal data of dental practice owners for the purpose of telephone advertising unless the data subject has given their consent or a business relationship with the data subject already exists. Furthermore, the DPA ordered the deletion of the data collected and stored for this purpose and instructed the controller to implement the ordered measures within two weeks of the order becoming final and to notify the DPA thereof. The controller applied to the DPA for annulment of the decision. As grounds, it essentially argued that her conduct was lawful under the GDPR, which had since entered into force, so that a new issuance of the order would not be possible. The DPA rejected the application, essentially stating that the legal situation had not changed in the controller's favor. The Administrative Court dismissed the controller's action seeking an order requiring the DPA to annul its decision. The Higher Administrative Court held that in the absence of consent under Article 6(1)(a) GDPR, the admissibility of the controller's data processing for direct marketing purposes now depends on the applicability of Article 6(1)(f) GDPR, which requires a comprehensive proportionality assessment and a balancing of the conflicting interests of the advertiser, on the one hand, and the recipient of the advertising, on the other. However, the requirements of Article 6(1)(f) GDPR are not met because the telephone advertising practiced by the controller does not meet the requirements of the Unfair Competition Act. With the appeal, the controller is pursuing its request further claiming that it can rely on Article 6(1)(f) GDPR as the legal basis for its data collection and processing. = The court held, that the controller's conduct violated the GDPR because the controller processed personal data of the dentists concerned without their consent. The court held, that contrary to the opinion of the lower court Article 95 GDPR does not render Article 6(1)(f) GDPR inapplicable in this case, because [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] does not constitute a provision in relation to which the GDPR imposes "additional obligations" on natural or legal persons. The court found that rather Article 13(3) of the e-privacy directive contains stricter requirements with regard to unsolicited direct marketing communications than the GDPR. Therefore, the court held that Article 6(1)(f) GDPR and [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] are, in principle, applicable concurrently. == However, the court held, that when assessing whether the data processing is carried out to safeguard a "legitimate interest", the assessments of [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG] must be taken into account. The court found that the fundamental question of whether standards and valuations of national law may generally be applied when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR can remain open since the German legislator implemented [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] with [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG]. It would, the court held, be in any event contrary to the principle of the unity of the Union legal order, if this implementation of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML rticle 13(3) of the e-privacy directive], which is applicable in accordance with Article 95 GDPR alongside the GDPR, had to be disregarded when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR. Additionally, the court considered, the CJEU had held that the coexistence of remedies under data protection law and competition law does not pose a threat to the uniform enforcement of the GDPR. == The court found, that the controller lacks a legitimate interest within the meaning of Article 6(1)(f) GDPR because the purpose of its data processing violates [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG]. According to [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG], a commercial practice that unreasonably harasses a market participant is impermissible. According to [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(1) UWG], this applies in particular to advertising, even though it is evident that the market participant addressed does not want this advertising. Following on from this, [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG] stipulates that unreasonable harassment is always to be presumed when advertising is carried out by telephone to a consumer without their prior express consent or to another market participant without their at least presumed consent. Presumed consent requires that, based on specific factual circumstances, the dentist can be presumed to have a justified interest in the telephone advertising. The court held that such an objectively justified interest of dentists in the sale of dental gold to the controller could not be established, because * an interest could not be inferred simply from the fact that the dentists called published their telephone numbers in publicly accessible directories, as this served solely to ensure accessibility for patients. * The sale of dental gold for profit is neither typical nor essential to the work of a dentist = The court held that the discretion generally granted to the DPA under the GDPR is limited in the present case to the extent that the DPA must intervene and impose a ban on the processing of the personal data of dental practice owners without their consent for the purpose of telephone advertising pursuant to Article 58(2)(f) GDPR. The court found that since the controller already lacked a legitimate interest within the meaning of Article 6(1)(f) GDPR, a design of the processing that complies with data protection law is not possible thus establishing an enforceable legal obligation for the controller to cease the processing is necessary.
Court case Ra 2024/04/0424
= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities didn’t fall within the scope of journalistic purposes. The court emphasised that the controller placed the cookies and processed the collected data for analytical and advertising purposes. Regarding the need for an equivalent reject option in cookie banners the court upheld the interpretation of the DPA that the first layer of the cookie banner needs to contain a visually equivalent option to reject cookies. = The controller appealed the BVwG's decision. In this appeal, the controller stated, that there is a lack of case law on the media privilege and on the design of cookie banners. The controller argued, that the Supreme Administrative Court (Verwaltungsgerichtshof - VwGH) had not yet dealt with this in substance and that thus clarification by it was required. Regarding the design of the cookie banner the court found that Article 7(3) GDPR requires an individual case-by-case examination whether refusing consent is as simple as granting it. The court held that an appeal can only be justified in cases of a blatant misassessment of the individual case-related circumstances by the first instance court. The court did not find this in the present case, stating that the reasoning of the first instance court was detailed and comprehensible. Regarding the media privilege the court held, that the appeal did not indicate which specific legal question the court would have to answer in this context.
Court case W252 2282050-1/12E
On the 09 August 2022, a data subject, represented by noyb, filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the controller unlawfully processed their personal data without the data subject's valid consent. The data subject alleged that, due to the use of dark patterns by the controller, the principle of transparency was violated and that the withdrawal of consent was not as easy as its issuance. Therefore, the data subject requested the erasure of their personal data. The option to reject cookies was a link, which was only identifiable as a link when hovering over it with the mouse. The accept button on the other hand was strongly highlighted by being placed in the middle of the banner and in a colour with strong contrast to the background. On the 22 September 2023, the DSB issued a decision on the following three points: Point 1: The data subject’s right to erasure had been violated under Article 17 GDPR. Point 2: The data subject’s right to privacy had not been violated under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=04-11-2022 §1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG). Point 3.a: The DSB ordered the controller to alter its cookie banner to make the “reject all cookies” appear in equal format to the “accept all cookies” option. Point 3.b: The controller must implement a function, which makes the revocation of consent just as simple as its declaration. The controller appealed points 1, 3a and 3b of the decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The controller posited that the GDPR does not require the “accept” and “reject” buttons to be displayed in an equal format. Further, it added that the revocation of consent was available through a footer link on the website which lead to the cookie settings. The court rejected the controller’s appeal. Point 1: The data of the data subject, at the latest, had to be deleted when the complaint was filed as it clearly showed a revocation of consent to the data processing under Article 17(1)(b) GDPR. Point 3.a: The court acknowledged that the cookie banner impairs users because of its size and they would quickly click on the highlighted accept option. In particular, they will not have understood the implications of the data processing. Furthermore, consent is not unambiguous as users are clearly nudged by the design. This is also contrary to the principle of transparency, as it points users towards the more invasive data processing option. In addition, the cookie banner creates a situation "where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected" (Recital 58 GDPR). The court concluded that the controller could not prove that the data subject gave unambiguous consent as per Article 7 GDPR. Point 3b: The court highlighted that under Article 7(3) GDPR, withdrawing consent should be as easy as giving consent meaning that the action required to revoke consent must be just as simple as the action for agreeing to the data processing. The court agreed with the DSB stating that it is not clear where exactly consent can be withdrawn based on the information provided in the cookie banner. The court considered that a floating icon is not necessary to withdraw consent because otherwise the option to withdraw consent would constantly block a big part of the screen.
Court case W298 2274626-1/8E
The data subject had brought a complaint to the Austrian DPA against the controller, a political party. The data subject detailed that he had visited the controller’s website and noticed that Google reCaptcha was being used on the website even though the data subject had deactivated Google reCaptcha. After the data subject had deactivated all cookies and functions such as Google reCaptcha, he clicked on the “become a member” page on the website, which showed the transfer of 615 packages of information from and to Google. The data subject declared that he had not agreed to the data transfer and that he wasn’t adequately informed that his IP address and the connected data would be transferred to Google. Therefore, Google would have knowledge of which party the data subject wanted to become a member of. The controller told the DPA that the information on the data subject’s membership sign-up remained entirely confidential and could not be accessed by others. The controller saw itself responsible for the content of the website while the design was carried out by an external person. Further, users had the option to reject cookies through the cookie banner. If cookies were rejected then no storage nor data transfer took place. The data subject added on the 20 April 2023, that after the complaint with the DPA, the controller continued the practice. Google Fonts was automatically downloaded and users were only informed of this in the privacy policy after the download had been completed. The DPA found that the data subject’s right to privacy had been infringed upon through implementing Google reCaptcha and processing the data subject’s IP address, certain unique identifiers and browser data. The cookie “_GRECAPTCHA” was held not to be of technological necessity and therefore required the data subject’s explicit consent. Therefore, none of the legal basis under Article 6(1) GDPR applied. The controller appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). It argued that the DPA had not analysed with which browser and operating system the data subject had accessed the website. The BVwG held that the data subject had not given his clear consent to the reCatpcha data processing. Even though the controller had not listed Article 6(1)(f) GDPR as a legal basis for processing, the court analysed whether this could legitimize the data processing. The Google reCaptca service was held to be unnecessary and therefore the controller could not rely on a legitimate interest. Therefore, none of the legal bases under Article 6(1) GDPR applied and the data processing violated the data subject’s right to privacy under §1(1) of the Austrian Data Protection Act. The BVwG therefore upheld the decision of the DPA.
Court case W 108 2284491-1
The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. In the meantime the controller updated the settings of the cookie banner and introduced a reject button on its first layer, next to the accept button. Also, the link to manage the cookie settings was redesigned as a button. Moreover, the controller added a floating icon, allowing the website users to withdraw the consent given at any time. If a website user rejected the cookies or withdrew the consent via the floating icon, the controller would interpret such a conduct to be an objection under Article 21 GDPR. Additionally, the controller informed they deleted the data concerning the data subject. In response, the data subject emphasized that due to new settings of the website, the controller wrongly qualified certain cookies to be strictly necessary. In consequence, the controller installed the cookies before the website’s user interacted with the cookie banner, violating Article 5(3) ePrivacy Directive. Although the controller announced that it would implement a completely new cookie banner, they later retracted from that plan. The controller changed the cookie banner and – after improving it initially – removed the reject button again. Eventually, updated cookie banner didn’t include a reject button on the first layer any longer. The DPA issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”). The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). After hearing the parties and visiting the website itself the court issued its decision. The court dismissed the appeal of the controller as unfounded. == The controller’s processing activities didn’t fall within the scope of journalistic purposes. The court emphasised that the controller placed the cookies and processed the collected data for analytical and advertising purposes. == The court also upheld the interpretation of the DPA that the first layer of the cookie banner needs to contain a visually equivalent option to reject cookies. According to the court Article 7(3) GDPR implies that refusing consent shall be as easy as giving consent. In particular, refusing consent shall not require more interactions than giving consent. In the case at hand consenting required only one click, whereas rejecting consent required two clicks. Therefore no equivalence between the options was given. Furthermore, the different design of the options in the first layer – a button for consent on one hand and a link to access the second layer on the other – equally lead to the conclusion that the options cannot be considered equivalent. A mere explanation in the first layer of the cookie banner on how to reject cookies does not change this assessment. Additionally, the cookie manage link at the bottom of the website is not an equivalent option either, since it is only available after an interaction with the cookie banner. Hence, the DPA order was found to be correct. The court did not find that the controller had complied with this order in the meantime.
Court case W108 2280724-1
The data subject visited a website, for which the controller was responsible. Upon accessing the website, the data subject was presented with a 'Consent Management Platform (CMP or cookie banner)' that, according to the data subject, violated Article 6 GDPR. The data subject filed a complaint to the Austrian DPA (DSB) on 10 August 2021. The data subject was represented by noyb. During the proceedings before the DPA: * the controller claimed to have reworked the design of the CMP and to have deleted the contested personal data of the data subject; * the data subject replied to this statement claiming that even though the violations identified in the complaint had been remedied by the new design of the CMP, certain cookies were then classified as 'strictly necessary' (within the meaning of Article 5 (3) ePrivacy Directive) and thus set as 'always active'; * in response, the controller claimed not to have processed any personal data without the data subjects consent. In addition, the controller explained that the note 'always active' for certain cookies was incorrect and had only not been removed by the time of the data subject's statement for technical reasons; * the data subject explained that the cookies had still been incorrectly classified and various non-required cookies were set without interaction with the banner. The controller claimed they had revised the cookie settings and the banner again and the contested cookies that were not deemed strictly necessary were not being set anymore if consent was not given; * the data subject stated their data was indeed processed without their consent upon visiting the website and that the processor had not explained in sufficient detail to what extent certain cookies were considered strictly necessary. The DPA dismissed the complaint. However, it also officially instructed the processor in point 3) of their decision to adapt the website and the banner in such a way to be compliant with Article 4(11) GDPR and Article 4(7) GDPR and Article 7(3) GDPR, respectively. The controller lodged a timely appeal against point 3) of the decision with Austrian Federal Administrative Court (BVwG). The controller claimed that the design of the cookie banner was in compliance with Article 7(3) GDPR as it already has a sufficiently marked option to revoke consent. Furthermore, the processor claimed not to have set cookies that are not technically necessary and the website is therefore already in compliance with Article 4(11) GDPR and Article 4(7) GDPR. The controller submitted an additional statement on June 6, 2024 that it decided not to operate the website any further and redirect visitors to a different website. The processor claimed that this provided another reason to annul point 3) of the decision of the DPA. The data subject issued multiple statements during the proceedings, claiming that the new website violates Article 4(11) and Article 4(7) GDPR and Article 7(3) GDPR in the same way as the previous website did. The court gave way to the appeal of the controller and annulled the contested point 3) of the DPA decision. After the changes made to the design of the CMP, there were clear textual instructions given as to how to grant or revoke consent. It was then as easy for an averagely informed, attentive and circumspect consumer to grant consent as to revoke it and the CMP was therefore already in compliance with Article 7(3) GDPR. Upon visiting the latest version of the website, there were only strictly necessary cookies in terms of Article 5(3) [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058 ePrivacy Directive] active without consent and there was no processing of personal data that violated Article 4(11) and Article 4(7) GDPR.
Court case 9 O 173/24
The data subject is a user of a social network platform, which also provides a messaging service. This platform is managed by a company with its headquarter in the USA. The data subject initiated a lawsuit before the Regional Court of Traunstein (Landesgericht Traunstein – LG Traunstein). Firstly, she argued that the controller is constantly monitoring her private messages and that the privacy policy is not transparent and is too complex. Secondly, she argued that, through cookies, the controller is collecting data relating to activities that happen outside the social network without her consent. Thirdly, she claimed that the controller forwarded all her personal data from and in connection with her account to the USA. She argued that this transfer is unlawful since the USA did not guarantee a level of protection equivalent to the GDPR. Therefore, the data subject asked the court to order the controller to pay non-material damages. As for the first argument, the controller pointed out that it conducts scans on the private messages only when to detect child sexual abuse material (CSAM) in compliance with the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32002L0058 ePrivacy Directive 2002/58/EC] (see [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32021R1232 Article 3 Regulation (EU) 2021/1232]). Moreover, the controller argued that it is respecting its transparency obligations and that the transfer of data to the US is legal since there is an adequacy decision and, before that, there were SCCs. First of all, the court ruled that the data subject has not demonstrated that the controller is systematically and automatically monitors the content exchanged via the messenger service. In every case, it found that the controller has proven that it carries out only permissible CSAM scanning. According to the court, this processing is covered by the legal basis provided for by Article 6(1)(f) GDPR. Secondly, it held that, due to the extensive data protection requirements that are imposed on the controller, the privacy policy cannot be more concise or simpler. Therefore, it found no violation of Article 13 and 14 GDPR. Thirdly, it did not uphold the data subject’s argument about cookies. It found that the controller could rely on consent under Article 6(1)(a) and 9(2)(a) GDPR to collect this data. Fourthly, the court noted that the social media platform at hand is designed as a global platform whose aim is to allow users to have a worldwide network and allow users to have “friends” from all over the World. Therefore, according to the court, it is obvious – and also the data subject should know this – that data is also transmitted to the USA, especially since the search for users in other jurisdictions can only work if there is a cross-border exchange of data. Moreover, the court believed that the business decision of the controller transfer data to the USA is to be accepted by the data subject since no one is forced to use the platform. Furthermore, it held that the data transfer at hand is necessary for the performance of a contract and, therefore, lawful under Article 6(1)(b) GDPR. Finally, as for Chapter V GDPR, the court pointed out that currently the controller can rely on the [https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj Commission Implementing Decision EU 2023/1795] which allows data transfers to the USA under Article 45(3) GDPR. As for the preceding period, it found that the standard contractual clauses adopted by the European commission in 2010 and 2021 according to Article 46(2)(c) GDPR provide a sufficient legal basis. According to the court, the fact the US government authorities can access the data transferred by the controller does not prevent the guarantee of an essentially equal level of protection since it is also possible for EU authorities to have such an access under Article 6(1)(c) GDPR. Moreover, the court ruled that the data transfer is however lawful since it is necessary for the performance of the contract under Article 49(1)(b) GDPR. On these grounds, the court dismissed the data subject's requests.
Microsoft Corporation
The controller, Microsoft Corporation, provides the service “Microsoft advertising” which enables website operations to place adverts in the search results of the "Microsoft Search Network". It can also collect information about the visitors to a website and to place targeted adverts for these visitors via cookies. The data subject visited third-party websites. She claims that the controller’s cookies were placed on her device without her consent. A forensic analysis of the recorded network traffic revealed that cookies from the controller had been placed on the data subject’s device without their consent. The data subjected sought injunctive relief at the Regional Court of Frankfurt am Main (“Landgericht Frankfurt am Main”) and requested the court to order the controller to refrain from using cookies on her end devices without her consent. The court refused to issue an interim injunction and dismissed the case. The court stated that grounds for an injunction were lacking and that the data subject did not demonstrate that they would otherwise suffer considerable disadvantages and that they cannot reasonably be expected to wait for the main proceedings. The court held that the data subject had the option to block the storage or reading of cookies via the internet browser settings, while the controller would have to change its complete processing, costing enormous effort in terms of time and money. Thus, the balance of interests is therefore in favour of the controller. The data subject appealed this decision at the higher regional court of Frankfurt (“Oberlandesgericht Frankfurt am Main”), arguing that the balance of interests is in their favour as there can be no right to exercise an unlawful business model. Moreover, the data subject had to live with the uncertainty of the whereabouts of its data, the associated loss of control and the fear of disclosure to unauthorised third parties. The data subject requested the court to amend the first judgement, to grant the injunctive relief and to refrain the controller from using cooking and similar technologies on the data subject’s devices without their consent. Claim for injunctive relief The court held that the German national implementation of the [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058 e-Privacy Directive] (“[https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TTDSG]” does not exclude a claim for injunctive relief under civil law. Obtaining consent The court held that under [https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html §25 TTDSG], the controller must ensure that the consent of the end user is transmitted to it by the website operator before it stores its cookies on the end user’s device. By failing to obtain consent, the controller violated [https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html §25 TTDSG]. The court dismissed the controller’s argument that the data subject could possibly have given her consent during an earlier visit. The court held that the controller had the burden of proof to provide evidence of prior consent. The fact that the controller could not provide this evidence, as it outsourced the obtaining of consent to third parties (the website operators) could not change its burden of proof. The court found it irrelevant whether ensuring that consent is obtained is possible for the controller through appropriate technical precautions. The court held that it could not understand why it should not be possible for the controller to store its cookies on the end devices of users only after it has received their consent. The court further held that even if such technical precautions do not exist, this does not affect the requirements of [https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html §25 TTDSG]. Liability The court further dismissed the controller’s argument that it is not liable under [https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html §25 TTDSG] for placing cookies without the consent of the end user, but the website operators. The court held that the fact that the website operators are responsible for obtaining consent according to their general terms and conditions does not exonerate the controller form liability. Liability is not limited to only the website operators, but also those who stores or accesses the cookies, such as the controller. The court held that the controller was also a provider under the meaning of [https://www.gesetze-im-internet.de/ttdsg/BJNR198210021.html §2 TTDSG], as it contributes to the provision of the website operator's telemedia by setting the cookies. According to this provision, a "provider of telemedia" is any natural or legal person who provides their own or third-party telemedia, contributes to the provision of telemedia or provides access to the use of their own or third-party telemedia. Balancing of interests The court did not agree with the first instance court that the injunction would lead to an unduly heavy burden for the controller. The court did take into account that the data subject cannot be recognised on the Internet when visiting pages, and therefore, the injunction cannot only be limited to the data subject, but rather has an overarching effect and requires a universal solution. However, the court held that the fact that the effect of the injunction extends beyond the devices of the data subject does not call into question the grounds for an injunction, but is the consequence of how the controller organised its business model. As the data subject had also argued, the court held that there are technically easy-to-implement solutions that enable consent to be transmitted to the website setting the cookie. If the controller cannot convince its customers of implementing these solutions, and thus being legally compliant, this should not negatively impact the data subject. Furthermore, the violations of the data subject’s rights were also intensifying daily, as the storage period of the cookie was 13 months and the storage of further user behaviour on other visited websites was possible. Conclusion Thus, the court ordered the controller to refrain from placing and storing cookies on the data subject's end devices without consent. If the controller violates the injunctive order, the controller could be fined up to €250,000 for each violation.
The data subject visited several popular websites and refused all cookies. However, tracking cookies were still placed on the data subject’s device. The controllers are Linkedin Ireland, Linkedin Netherlands, Microsoft Corporation (US), Microsoft Ireland Operations, Microsoft (NL) and Xandr (US). LinkedIn offers an advertising service and allows for companies to place tracking cookies on the browsers of a user after they view or click their ads. Microsoft has an advertising service that sells ad space on various websites. The service also allows advertisers to show their ads on the ad space of 'third-party' website operators and can place tracking cookies on the devices of website visitors. Xandr is an online platform that buys and sells digital ads. To use the services of Xandr, website users need to install a Java-script that places tracking cookies on the devices of website visitors. All of them are part of the Microsoft Group. The data subject hired a third party specialist to make an independent analysis of the controllers’ collection of personal data via the placed cookies. The analysis confirmed that out of the 30 websites the data subject visited, 27 websites placed and/or read cookies without the data subject’s consent. 24 websites did this even after explicit refusal to consent. Thus, the controllers were collecting personal data of the data subject’s browsing habits without their consent. The data subject filed an urgency procedure (“kort geding”) at the Amsterdam District Court (“Rechtbank Amsterdam”), asking the court to forbid the controllers to place tracking cookies without the data subject’s consent. Jurisdiction of the court [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Brussels I bis Regulation] regulates which courts of the EU Member States have jurisdiction in cases with links to more than one Member State in the EU. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bis Regulation] states that, in matters relating to tort, delict or quasi-delict, a person domiciled in a Member State may be sued in another Member State if the harmful event occurred or may occur in that Member State. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 8(1) of the Regulation] states that a person can also be sued in another Member State when one of the defendants is domiciled where the court is also located, "provided the claims are so closely connected that it is expedient to hear and determine them together to avoid the risk of irreconcilable judgments resulting from separate proceedings.” Although some of the controllers are established in Ireland, the court held that it had the jurisdiction to rule on this matter: a) under Article 79(2) GDPR, as the data subject had their habitual residence the Netherlands and, b) under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bis Regulation], as Amsterdam is the place where the harmful event occurred and, c) under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 8(1) Brussels I bis Regulation], as two of the controllers are established in the Netherlands and there is a close link between the claims against the controllers. The court rejected the controllers’ argument that the “place where the harmful event occurred” is only applicable when the data subject demands a claim for damages, because it could not be inferred from the legislative history and case-law that jurisdiction on the bases of where the harmful event occurred only applies to compensation claims. The court held that with regards to the controllers established in the US, Brussels I bis Regulation did not apply, but [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Articles 1-14 of the Dutch Civil Procedure Code] did. The court held it had the jurisdiction under [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Article 6 of the Dutch Civil Procedure Code] (in case of unlawful acts, jurisdiction is based on the place of the harmful event) and [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Article 7 of the Dutch Civil Procedure Code] (there is such a connection between the claims against the various defendants that reasons of efficiency justify a joint procedure). Urgency Furthermore, the court held that the data subject had an urgent interest, because if the controllers were acting unlawfully by violating the data subject’s privacy rights, the court must put an end to this as soon as possible. Therefore, the court held that the data subject cannot be asked to wait for a decision through a normal court procedure and allowed for the urgency procedure. Joint controllership The court rejected the controllers’ argument that they were merely processors and that the responsibility lied with the website operators. The court ruled that under Article 4(7) GDPR, LinkedIn, Microsoft and Xandr were controllers as they determined the means and purposes of data processing. This responsibility remains even if the controllers outsourced the obtaining of consent to their partners (the website operators). Under Article 26 GDPR, multiple parties can be jointly responsible for the processing of personal data. Therefore, the court held that LinkedIn, Microsoft and Xandr were considered joint controllers, and thus responsible for complying with the GDPR. Personal data and consent The court rejected the controllers’ argument that they do not process personal data with their tracking cookies under Article 4(2) GDPR. The court stated that the controllers acknowledged that most of the cookies were set for the purpose of capturing personal data, which can be used to build profiles that can be read for advertising purposes. Moreover, the court held that already placing a cookie that automatically collects personal data constitutes a processing of personal data, and not only when personal data collected by the tracking cookie is actually read for the purpose of advertising. The court dismissed the argument of the controllers that some of these cookies were not tracking cookies and thus not processing personal data. The court held that under Article 6 GDPR and [https://privacy-web.nl/wetgeving/telecommunicatiewet/hoofdstuk-11-bescherming-van-persoonsgegevens-en-de-persoonlijke-levenssfeer/%C2%A7-11-1-algemene-bepalingen/artikel-11-7a/ Article 11.7a of the Dutch Telecommunications act], the placing and reading of tracking cookies requires consent of the data subject. Controllers must demonstrate that they have consent under Article 5(2) GDPR. The court took into account the independent analysis that showed that websites placed cookies without the consent of the data subject, even after rejecting consent. The court also found that the controllers failed to prove that their tracking cookies were only placed on the data subject’s devices after his consent. The fact that the findings in the analysis are not representative because hundreds of other websites that have the controllers’ tracking cookies do comply with the GDPR by not placing cookies without consent was deemed irrelevant. Responsibility of the controllers The court stated that controllers were allowed to contractually outsource the obtaining of consent to their partners (the websites placing these tracking cookies), meaning that these websites provide information about and obtains consent for the placement of cookies. The controllers do not necessarily have to provide this information and obtain consent themselves as well. However, the court held that the controllers cannot put the sole responsibility on their partners for obtaining consent. The controllers remain (also) responsible themselves for ensuring consent is obtained in a legally valid and lawful manner for the placement and reading of the tracking cookies. The court thus held that controllers can be held liable for this on the basis of Article 26(3) GDPR, regardless of what the contract with its partners states. The court stated that the controllers could have made tools available to their partners that made it impossible to place tracking cookies without consent. If that would have been the case, there would be no unlawful conduct by the controllers. However, this was not done by the controllers. Therefore, the court held that the controllers could not rely on the fact that they have done everything necessary, or at least everything that can be required of them, to prevent the placement of tracking cookies on the data subject’s devices without his consent. Conclusion The court concluded that the controllers violated the GDPR and the Dutch Telecommunications Act by placing and reading tracking cookies without the consent of the data subject. The court thus prohibited the controllers from placing or reading tracking cookies on the data subject's devices without his consent. The court also imposed a penalty of €500 per violation (or €1000 per day), up to a maximum of €25,000 per company until they complied. Lastly, the court ordered the controllers to pay the data subject’s legal costs.
La Quadrature du Net
In order to protect works covered by copyright against their communication on the Internet without the authorization of the holder of the rights, France adopted Decree n. 2010-236, which introduced in particular, [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000020740267/2009-11-01/ Article L. 331-21 in the French Intellectual Property Code] (‘CPI’). This Article establishes that the High Authority for the dissemination of works and the protection of rights on the Internet (‘Hadopi’) may request the identity, postal address, email address and telephone number of a person who made protected works available to download on the Internet, from internet service providers. The purpose of this access is to enable Hadopi to initiate a procedure against the identified person, combining educational and punitive measures. In particular, the sending of a first and second recommendation and then a letter notifying them that that activity is liable to constitute gross negligence. The matter may be referred to the public prosecution service in the most serious cases. Four associations, including La Quadrature du Net, sought the annulment of this Decree, claiming that [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000020740267/2009-11-01/ Article L. 331-21 CPI] was contrary to EU law, in particular [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15 ePrivacy Directive] and [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7], [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8] and [https://fra.europa.eu/en/eu-charter/article/11-freedom-expression-and-information 11] of the Charter. Regarding the alleged infringement of EU law, La Quadrature du Net submitted that this Article permits access to any connection data in a disproportionate manner for non-serious copyright offences committed on the Internet, without any prior review by a judge or an authority. In particular, they indicated that the offences did not fall within the scope of 'serious crime'. First, the Conseil d’Etat pointed out that the CJEU held that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) ePrivacy Directive] does not preclude legislative measures which, for the purposes of safeguarding national security; combating crime and safeguarding public security, provide for the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=232084&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=21520025 CJEU, 6 October 2020, La Quadrature du Net and Others]). Second, the Conseil d’Etat referred to CJEU case law in which the Court held that the access to the data retained should, as a general rule, be subject to a prior review carried out by a court or an administrative independent body. The Conseil d’Etat noted that Hadopi has issued over 12,7 million recommendations to subscribers under the procedure provided for in Article L. 331-25 of the CPI. Therefore, Hadopi have necessarily had to collect a considerable volume of data relating to the civil identity of the users concerned. The Conseil d’Etat decided to stay the proceedings and referred three questions to the CJEU, which the Court considered appropriate to examine together. Therefore, the CJEU examined the following question: * Does [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) ePrivacy Directive] preclude a national legislation which authorises a public authority to access data retained by providers of publicly available electronic communications services, relating to the civil identity associated with IP addresses in order to identify the holders of these addresses – which have been used for activities liable to constitute infringements – and may take measures against them, all this, without any prior review by a Court or an administrative body? Preliminarily, the CJEU clarified that the questions raised by the Conseil d’Etat only concern the downstream processing. This processing takes place in two stages: (i) the IP addresses collected are matched with the holders of those addresses and (ii) a set of personal data and information relating to the holders, in particular their civil identity, is made available to the public authority (§55 and 58 of the Judgement). The CJEU added that the collection of IP addresses, with certain quantitative limits and under certain conditions, with a view to their transmission to Hadopi for the purposes of their potential use in administrative or judicial proceedings to combat activities which infringe copyright related rights, constitutes ‘processing’ within the meaning of Article 4(2) GDPR (§62 of the Judgement). Retention of data relating to civil identity and associated IP addresses by Internet service providers The Court noted that although, formally, Hadopi is authorised to access only data relating to the civil identity associated with an IP address, the access first requires the Internet service providers to match the IP address with the civil identity data of the holder of that address. This presupposes that the providers have the IP addresses as well as the data relating to the identity of the holders of those addresses (§71 of the Judgement). In particular, Hadopi seeks access to those data for the sole purpose of identifying the holder of an IP address which has been used for activities liable to infringe copyright or related rights, since they have made protected works available on the internet for downloading by others. The CJEU therefore considered that the data relating to civil identity must be regarded as being closely linked to the IP address and the information that Hadopi has concerning the work made available on the Internet (§72 of the Judgement). According to the Court’s case-law, IP addresses constitute traffic data, but are distinct from other categories of traffic and location data. Thus, IP addresses do not, as such, disclose any information about third parties who were in contact with the person who made the communication, and are therefore less sensitive than other traffic data ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=232084&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=21520025 CJEU, 6 October 2020, La Quadrature du Net and Others], §152). Nonetheless, IP addresses may, when used to ‘track an internet user’s complete clickstream’ enable a detailed profile of the user to be produced. This does in fact constitute a serious interference with the fundamental rights of the Internet user enshrined in Articles 7 and 8 of the Charter (§78 of the Judgement). However, the CJEU considered that the general and indiscriminate retention of a set of static and dynamic IP addresses does not necessarily constitute, in every case, a serious interference with fundamental rights (§79 of the Judgement). The CJEU found that a Member State which seeks to impose on providers of electronic communications services an obligation to retain IP addresses in a general and indiscriminate manner in order to combat criminal offences must ensure that it is not possible to draw conclusions about the private life of the person by combining the IP addresses with other data (§83 of the Judgement). Thus, there must be clear and precise rules relating to the retention agreements in such a case. The CJEU added that the legislative framework must provide a retention period limit to what is strictly necessary. It must also ensure by means of clear and precise rules that the retention of data is subject to compliance with applicable substantive and procedural conditions. Finally, the persons concerned must have effective safeguards against the risk of abuse and any unlawful access to those data (§93 of the Judgement). Access to data relating to the civil identity associated with an IP address retained by Internet service providers It follows from the CJEU’s case law that, in the field of combating criminal offences, only the objectives of combating serious crime or preventing serious threats to public security justify the interference with fundamental rights entailed by access to a set of traffic or location data ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=238381&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=3488157 CJEU, 2 March 2021, Prokuratuur, C-746/18], §35). However, when the public authority’s access to data relating to civil identity cannot be associated with information on the communications made, the interference with fundamental rights is not serious. The CJEU considered that those data do not allow precise conclusions to be drawn concerning the private life of the person. Therefore, the access may be justified by an objective of prevention, investigation, detection and prosecution of criminal offences in general ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=206332&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=3488495 CJEU, 2 October 2018, Ministerio Fiscal, C-207/16], §54, 57 and 60). The CJEU found that in the present case, the national French legislation does not allow Hadopi to have access to a ‘set of traffic or location data’. Therefore, in principle, it cannot draw precise conclusions about the private lives of the persons concerned (§99 of the Judgement). The Court also held that the national legislation must lay down clear and precise rules which ensure that IP addresses retained can only be used to identify the person while precluding any use that allows the surveillance of that person’s online activity (§101 of the Judgement). Furthermore, the CJEU noted that it cannot be ruled out that said access, combined with an analysis of even limited information on the content of the work made unlawfully available by the person, may reveal certain aspects of the private life of the person, including sensitive information (§110 of the Judgement). In the present case, the CJEU ruled that in view of the nature of the limited data and information made available to Hadopi, only in rare cases would they reveal potentially sensitive information which would allow the authority to draw precise conclusions about their private life (§111 of the Judgement). Additionally, the CJEU considered that the interference with the privacy of the person suspected is not necessarily of a high degree of seriousness. Firstly, Hadopi’s access is restricted to a limited number of authorized and sworn officials. Secondly, the sole purpose of the access is to identify a person suspected of having engaged in an activity infringing copyright when the protected work has been unlawfully made available from that person’s internet connection. Thirdly, Hadopi’s access to the personal data is strictly limited to the data necessary for that purpose (§113 of the Judgement). Lastly, Hadopi officials who have access to the data are bound by an obligation of confidentiality which prohibits them from disclosing the data, except for the sole purpose of referring the matter to the public prosecution service (§114 of the Judgement). The CJEU held that if the national legislation sets out clear and precise rules that do not allow the surveillance of the person’s online activity, e.g. Hadopi tracking the clickstream of a person via IP addresses, the authority’s access cannot be classified as a serious interference with their fundamental rights (§115 of the Judgement). Prior review by a court or an independent administrative body of the access request The CJEU held that in the present case, a prior review must take place before Hadopi can link the civil identity data of a person associated with an IP address obtained from a provider of electronic communications services, and the file relaying to the work made available on the Internet for downloading by others. The review must take place before sending a notification letter declaring that that person engaged in conduct liable to constitute gross negligence (§141 of the Judgement). Moreover, the CJEU added that a prior review may in no case be automated since balancing the various legitimate interests and rights concerned requires human intervention. Safeguards against abuse and unlawful access by the public authority to data relating to the civil identity associated with the IP address The CJEU pointed out that the French Government confirmed that Hadopi’s access to data relating to civil identity is the result of essentially automated data processing (§154 of the Judgement). The Court noted that such automated processing is likely to involve a certain number of false positives, and there is a risk that a significant amount of personal data may be misused by third parties. Therefore, it is important that under a legislative measure, the data processing system used is subject to a review by an independent body (§156 of the Judgement). The CJEU also excluded the processing by Hadopi from the scope of the GDPR, as Article 2(2)(d) GDPR provides that the regulation does not apply to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences (§160 of the Judgement). Therefore, the CJEU concluded that a national provision that authorises a public authority to access data relating to civil identity associated with IP addresses, retained by Internet service providers, in order to identify the holders of the addresses which have been used for activities liable to constitute infringements is compatible with Article 15 ePrivacy Directive. However, this legislation must ensure that: * The data does not allow precise conclusions to be drawn about the private life of the IP address holder, for example by establishing a detailed profile of the person. Therefore, an obligation must be imposed on Internet service providers to retain the various categories of data in a way that ensures a watertight separation of these different categories; * The public authority’s access to data serves exclusively to identify the person suspected of having committed the criminal offence; * The possibility of linking the data with the title of the protected work made available on the Internet is subject, in cases where the person repeats an activity infringing copyright, to review by a court or an administrative body; * The data processing system used by the public authority is subject to review to verify the integrity of the system.
CJEU case C‑178/22 Procura della Repubblica presso il Tribunale di Bolzano
Two complaints were lodged with the Italian Public Prosecutor's office concerning acts of mobile theft. In order to identify the perpetrators, the Public Prosecutor's office requested an authorisation to obtain the telephone records of the stolen telephones from all the telephone companies. These requests concerned all the data in the possession of the telephone companies, with tracking and localisation methods, in particular the users and International Mobile Equipment Identity (IMEI) codes of the devices called or making the calls, the sites visited and reached, the times and durations of the calls and connections, the details of the cells and/or towers concerned, and the users and IMEI code of senders and receivers of SMS and MMS. These requests were made to the judge responsible for preliminary investigations at the District Court, Bolzano (‘Giudice delle indagini preliminari presso il Tribunale di Bolzano’) on the basis of an Italian National law, [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003]. The referring court was uncertain whether [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003] is compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) of Directive 2002/58] (‘ePrivacy Directive’) as interpreted by CJEU, 2 March 2021, Prokuratuur, C-746/18. First, according to paragraph 45 of that judgement, national provisions that allow public authorities to access telephone records containing a set of traffic or location data are justifiable if those provisions are intended for the prosecution of serious offences such as threats to public security and other serious crimes. Second, [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003] establishes that if there is sufficient evidence of the commission of an offence for which the penalty is a maximum term of imprisonment of at least three years, the Public Prosecutor may acquire data relevant to the facts, with the prior authorization of the court. According to the referring court, the Italian courts have a very limited margin of discretion to refuse authorisation to obtain telephone records as the authorization must be granted when there is ‘sufficient evidence of the commission of an offence’ and the data requested are ‘relevant to establishing the facts’. The Giudice delle indagini preliminari presso il Tribunale di Bolzano decided to stay the proceedings and referred the following question to the CJEU: * Does [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) of the ePrivacy Directive] preclude a national provision which requires a national court to authorise access to a set of traffic or location data for the purposes of investigating a criminal offence with a penalty of a maximum term of imprisonment of at least 3 years, provided that there is sufficient evidence and that those data are relevant to establishing the facts? Firstly, the CJEU indicated that access to traffic and location data retained by providers of electronic communications services may be granted to public authorities for the purposes of the prevention, investigation, detection and prosecution of criminal offences pursuant to a national law adopted under [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) ePrivacy Directive]. However, a legislative measure cannot allow the general and indiscriminate retention of traffic and location data as a preventative measure (§35 of the Judgement). The CJEU also held that only the objectives of combating serious crime or preventing serious threats to public security are capable of justifying a serious interference with the fundamental rights of [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7] and [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8 of the Charter] (§36 of the Judgement). Secondly, the CJEU assessed the question of whether access to the traffic and location data in the present case may be classified as a serious interference with the fundamental rights guaranteed by [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7] and [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8 of the Charter]. Access to the set of traffic or location data requested in the present case may allow precise conclusions to be drawn concerning the private lives of the persons whose data have been retained, for example the habits of their everyday life, their permanent or temporary places of residence, their daily movements, the activities they carried out, their social relationships and social environments frequented by them. The CJEU found that in such a case, the interference with the fundamental rights guaranteed in [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7] and [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8 of the Charter] would likely to be classified as serious (§39 of the Judgement). The Court considered that for the purposes of assessing the existence of a serious interference with the fundamental rights, it was irrelevant that the access may not concern the data of the owners of the phones, but the data of the persons who communicated with each other after the theft. Indeed, [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 5(1) ePrivacy Directive] establishes that the obligation to ensure confidentiality of the traffic data covers communications made by the ‘users’ of that network. The ‘users’ are defined as any natural person using a publicly available electronic communications service, without necessarily having subscribed to that service (§41 of the Judgement). Thirdly, the CJEU added that national law determines the conditions under which providers of electronic communications services grant access to the data in the provider's possession. However, the legislation must lay down clear and precise rules governing the scope and conditions for the application of such access. As a general rule, the CJEU noted that access can be granted in relation to the objective of fighting crime, only for the data of individuals suspected of being implicated in a serious crime. The Court also pointed out that in order to ensure that the interference is limited to what is strictly necessary, the access must be subject to a prior review carried out by a court or an independent administrative body. This does not apply in cases of duly justified emergency (§43 of the Judgement). Regarding the definition of the concept of 'serious offence', the EU has not legislated in that field. This concept reflects social realities and legal traditions, which vary between the Member States and over time. Therefore, it is up to the Member States to define 'serious offences’ for the purposes of applying [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) ePrivacy Directive] (§46 of the Judgement). The CJEU recalled that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) ePrivacy Directive] is an exception to the obligation to ensure the confidentiality of electronic communications and data and must not become the rule (§48 of the Judgement). Furthermore, the national measures taken by Member States under this provision must comply with the general principles of EU law, in particular the principle of proportionality and ensuring respect for the fundamental rights enshrined in [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7], [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8] and [https://fra.europa.eu/en/eu-charter/article/11-freedom-expression-and-information 11 of the Charter] (§49 of the Judgement). Therefore, the Court considered that Member States must not distort the concept of ‘serious offence’ and ‘serious crime’ by including within it, offences which are manifestly not serious offences. In the present case, the CJEU pointed out that [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) Legislative Decree n°196/2003] defines the offences for which access to data retained by providers of electronic communications services may be granted, by reference to a maximum term of imprisonment of at least three years. Additionally, there must be sufficient evidence to the commission of an offence and the data must be relevant to establishing the facts (§52 of the Judgement). The CJEU held that the definition of ‘serious offence’ cannot cover the vast majority of criminal offences, which would be the case if the maximum term of imprisonment was sent at an excessively low level. The Court considered that a maximum term of imprisonment of three years does not appear excessively low ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=261282&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=3492626 CJEU, 21 June 2022, Ligue des droits humains, C-817/19], §150). Lastly, the CJEU found that setting a maximum term of imprisonment may create a situation in which the access would be requested for the purposes of prosecuting offences which do not constitute a serious crime. However, the Court held that setting a minimum period above which the maximum term of imprisonment for an offence justifies the classification of that offence as a serious offence is not necessarily contrary to the principle of proportionality (§58 of the Judgement). Thus, the CJEU concluded that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) ePrivacy Directive] does not preclude a national provision which requires a national court, acting in the context of a prior review, to authorise access to traffic or location data for the purposes of investigating criminal offences punishable under national law by minimum 3 years imprisonment. However, the court must be entitled to refuse such access in the context of investigating an offence which is manifestly not a serious offence in the light of the societal conditions prevailing in the Member State concerned.
VOODOO
The controller appealed [https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2022-026 decision SAN-2022-026] of the French DPA ('CNIL') before the French Supreme Administrative Court ('Conseil d'Etat). The CNIL fined the controller €3,000,000 for failing to obtain data subjects' consent for advertising purposes, regarding "Identifiers for Vendors" when using the controller's apps on Apple devices. The DPA also ordered an injunction requiring the controller to bring its data processing into compliance within a period of three months from notification of the deliberation. This was subject to a fine of €20,000 per day of delay. The controller sought to reduce the fine amount. The Conseil d'Etat rejected the controller's request and upheld the DPA's €3,000,000 fine. First, Article 82 of the French Data Protection Act requires that any operation of collection or deposit of information stored in the terminal of a data subject must be subject to prior, clear and complete information relating to the purpose of cookies or other tracers and the means available to data subjects to oppose them, as well as the prior collection of their consent. Two exceptions exist to this requirement: (i) if the activity has the exclusive purpose of allowing or facilitating communication by electronic means and (ii) if it is strictly necessary to the provision of an online communication service at the express request of the user. The Conseil d'Etat considered that the DPA had sufficiently established the facts regarding the breach of [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the French Data Protection Act] (loi 78-17 du 6 janvier 1978, Informatique et Libertés), as the controller did not obtain the necessary consent to collect data subjects' data and its activities did not fall into one of the exceptions to this requirement. Second, the Conseil d'Etat also held that the DPA followed the correct procedures when deciding the fine to be imposed on the controller. In making the decision, the DPA correctly took into account several factors including for example the number of data subjects and the seriousness of the breach (Article 83(2)(a) GDPR), the financial situation of the controller in its economic sector and the fact the controller derived more than 95% of its income from advertising, and thereby gained financial advantage from the breach (Article 83(2)(k) GDPR). Finally, the Council d'Etat further noted that neither the GDPR nor the French Data Protection Act require the DPA to explain the reasoning behind the amount of sanctions imposed, and therefore the DPA had not disregarded the principle of legality and proportionality of penalties when deciding the penalty amount.
Court case W211 2281997-1/5 E
Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austrian Federal Administrative Court (‘Bundesverwaltungsgericht’ or ‘BVwG’). The BVwG does not consider that consent was actually forced and therefore involuntary. As an introduction, the BVwG recalled Article 7(4) GDPR which precludes the so-called ‘tying’. This means that the performance of a contract may not be made dependent upon the consent to process personal data, which is not needed for the performance of that contract. The BVwG referred to the German Data Protection Conference (‘DSK’) which, according to the BVwG, did not consider a provision of ‘free’ service offers ‘payed’ by users with their consent to be contrary to Article 7(4) GDPR.. Such offer should be presented to data subjects as a contractual agreement at the time of its conclusion. As a result, personal data could became the subject of a primary performance obligation of a legal transaction. The BVwG did not state explicitly how these considerations apply in the present case. Further, the BVwG refers to the CJEU judgment in C-252/21. This judgment would not be applicable in the present case. The BVwG emphasized that in the present case the controller is not in a dominant market position comparable to the one of Meta in C 252/21. The users’ freedom of choice is not affected the same way as described in the CJEU judgment C-252/21. The controller’s website cannot be compared to the pressure of a quasi-monopolistic online service that would not be accessible without consent. Additionally, the BVwG acknowledged that while data protection laws can limit private autonomy, in this case the controller had the right to determine the conditions for accessing its content, which includes requiring consent to tracking cookies (‘data as compensation for service’). A different interpretation of Article 6(1)(a) GDPR would not be proportionate. The court emphasized that users had alternative means to access the content, such as through a print edition or a digital subscription, and thus there was no disproportionate infringement on user rights. Consequently, the data subject cannot claim a right to access the website content under its preferred conditions, and the controller is not obliged to provide such access. The BVwG concluded that the controller obtained valid consent and annulled the decision of the DPA. This decision was appealed by the Austrian DPA to the Supreme Administrative Court (‘Verwaltungsgerichtshof’).
Criteo SA
The controller is Criteo SA, a global technology company operating in media and entertainment that does consultancy, provides software and services in relation to digital marketing, media advertising and real time ads bidding. The controller places tracking cookies for targeted advertising on computers and mobile devices of users visiting certain third party websites. The controller uses the Real Time Bidding (RTB) System to recognise a user within seconds and to show personalised ads. In another case against the controller on 15 June 2023 , the French DPA ("CNIL") fined the controller €40 million for violating various articles of the GDPR, in particular for failing to verify that the persons from whom it processed data had given their consent. On 8 August 2023, the data subject wrote to the controller that the placing of tracking cookies on the data subject’s devices without the data subject’s consent, violates [https://www.google.com/search?client=firefox-b-d&q=telecommunicatiewet+11.7a Article 11.7a(1) Dutch telecommunications law] (“Telecommunicatiewet – TW”) and Articles 5(1)(a), 6(1), 7, 13 and 14 GDPR. The controller responded that it is the responsibility of the third party websites to obtain consent. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The court prohibited the controller from placing tracking cookies on the devices of the data subject and imposed a penalty of €250 for every day they fail to comply with the decision (with a maximum of €25.000). The controller appealed this decision on 30 October 2023. The Court of Amsterdam (“Gerechtshof Amsterdam”) found that tracking cookies were placed by the controller and that the data subject’s personal data was processed in violation of the GDPR. The court therefore prohibited the controller from placing tracking cookies and upheld the imposed penalty of the District Court after the judgement came into effect. In January 2024, the controller voluntarily complied with the penalty of €25.000 before the judgement came into effect. On 17 April 2024, the controller initiated proceedings on the merits at the Amsterdam District Court, because it disagreed with the judgement in the urgency procedure. The controller argued that it did not place the cookies themselves, but that they were placed by third party websites. The controller argued that it did not have factual control or power over the way these websites design their websites and how they ask for consent. They can only contractually obligate these websites to obtain consent. If it appears these third party websites do not obtain consent, the controller can give a written warning. The controller also argued it is factually impossible to comply with the prohibition of the court as it cannot single out the devices of the data subject to stop placing tracking cookies. As the unlawful processing continued, the data subject requested the court to impose a penalty of €1.500 per violation or €5.000 per day the controller continues to place tracking cookies. By complying with the maximum amount of the penalty, the data subject argued that it appears that the business model of the controller is that lucrative that the imposed penalty is an insufficient financial incentive to stop the unlawful processing. Also the fine of 40 million by the French DPA did not change the behaviour of the controller. The court held that the controller already complied with the maximum penalty but paying the the penalty does not release the controller from the duty to comply with the prohibition. The court further held that it is the responsibility of the controller to check whether it complies with the prohibition to place tracking cookies on the data subject's devices. Although the controller made steps in the right direction by writing warnings and ending contracts with websites that did not comply, the prohibition is still not complied with. By paying the maximum penalty, the court held that the controller also knew it was not complying with the imposed prohibition. Therefore, the imposed penalty is an insufficient financial incentive to comply with the judgement and there are sufficient arguments to impose a new and higher penalty. The court also dismissed the argument of the controller that it cannot prevent that tracking cookies are placed on the devices of the data subject and can only comply with the prohibition by not placing tracking cookies at all irrespective of the device. The court held that this argument cannot relieve the controller from its obligation to comply with the judgement. Thus, the court imposed an additional penalty of €500 per day (with a maximum of €50.000) against the controller until it complies with the prohibition of placing tracking cookies on the data subject's devices.
Ministry of Industry and Trade of the Czech Republic
A journalist (‘data subject’) demanded an apology in relation to himself and to the citizens of the Czech Republic (‘CZ’) from the Ministry of Industry and Trade of the CZ (‘controller’) as a compensation for the non-material damages suffered as a result of the incorrect transposition of Directive 2002/58 of the European Parliament and of the Council /EC of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (‘e-Privacy Directive’ or ‘Directive’). According to the Czech law transposing the Directive, operators of electronic communications and public networks must store a variety of user communication information for six months, primarily to aid in the investigation of criminal and misdemeanor activates. The incorrect transposition of the Directive allegedly led to the widespread collection and processing of operation and location data of users' the electronic communications. In this case, the data subject saw an interference with his rights to privacy and informational self-determination. Before filing the lawsuit, the data subject tried unsuccessfully to obtain the erasure of data stored on him through a mobile operator and later through the Czech DPA. The DPA stated that, in their opinion, it is indisputable that the national legislation issue (§ 97 paragraph 3 of Act No. 127/2005 Coll.) is not in accordance with Article 15 ePrivacy Directive. According to the Directive, Member States may enact laws to limit certain rights outlined in the Directive, including data retention, if it is necessary for national security, defense, public safety, or crime prevention, in line with EU principles. However, the complaint was rejected by the DPA. Nevertheless, the data subject brought the DPA's opinion to the controller's attention who rejected it claiming that this transposition of the Directive cannot be considered as 'improper official procedure' according to Act No. 82/1998 Coll., on liability for damage caused in the exercise of public authority. The data subject filed a lawsuit at the District Court of Prague 1 which rejected the request of the data subject for an apology. It concluded that the alleged damage caused by contradiction of national legislation and EU law is only a ‘potential damage not eligible for the legal protection’. The court added that the data subject was not entitled to file a lawsuit which concerns compensation for non-material damage to all citizens. The data subject filed an appeal against this decision. the Municipal Court in Prague confirmed the first instance decision. Finally, the data subject filed another appeal at the Supreme Court to resolve the questions on: # state responsibility for erroneous transposition of e-Privacy Directive # the question of the occurrence of non-material damage. To begin with, the Supreme Court confirmed the decision of the court of first instance on the part regarding the lack of legal standing for seeking protection of the public interest. Such protection is not afforded by civil law and a person cannot claim damages for people that are not taking part in the procedure. Regarding the state responsibility for the legislative activity, the Supreme Court referred to the joint cases C-46/93 and C-48/93, Brasserie du pêcheur SA, Factortame Ltd and others. The CJEU confirmed that a violation of directly effective standards thus results in state liability for damage. Consequently, Act No. 82/1998 Coll. shall be applied reasonably only where its rules are consistent with those of EU law or cover issues not addressed by EU law and as long as it does not hinder the individual’s rights to seek compensation for damages. The Supreme Court, therefore, recalled three conditions for the state to be liable for a violation of EU law, namely: # the violated rule of EU law grants rights to the injured parties # the violation of this rule is sufficiently serious # there is a direct causal link between this violation and the damage suffered by the injured parties In relation to the damage suffered, the Supreme Court concluded that the harm to data subjects may consist of a mere "loss of control" over their own data. This is the case even if there was no actual misuse of the data in question to the detriment of said persons. Thus, if a data subject seeking damages on this basis argues that he fears that his personal data will be misused in the future as a result of such a breach, the national court to which the case was brought must verify that this fear may be justified. Regarding the data retention period, the Supreme Court said that practice of the Czech law has been consistently ruled illegal by the Court of Justice of the EU (e.g. C-293/12 and C-594/12, Digital Rights Ireland Ltd, C-203/15 and C-698/15, Tele2 Sverige). It concluded that EU law prevents such legislative measures which, for the purpose of combating serious criminal activity and preventing a serious threat to public security, preemptively provide for widespread and indiscriminate storage of operational and location data. According to the CJEU, extensive storage of operational and location data is only allowed when there is a serious threat to national security. The storage order should only last as long as absolutely needed, with the chance of extending it and reviewed by a court or independent body. The Supreme Court thus indicated that the Czech legal regime governing data retention might infringe on the right to privacy and personal data protection, directing lower courts to further examine this issue. The decisions of the lower courts will indicate whether retention of traffic and location data may be shortened in the CZ. In the event that the courts conclude in subsequent proceedings that the national regulation in question does not comply with the conditions of the Directive as interpreted by the CJEU, it will be necessary to examine, in accordance with the decision of the CJEU in the case of Brasserie du pêcheur SA, Factortame Ltd and others, whether this violation was sufficiently serious to consider the CZ liable for violation of EU law.
Court case 1 A 217/22 MD
The controller runs a web portal that connects operators of holiday homes to potential guests by allowing the operators to place ads on the portal. To acquire new operators to present their holiday homes the controller advertises their service via phone. They were using the services of a call centre in Kosovo for this purpose. Call centre staff members would search for phone numbers of landlords and operators of hotels and holiday homes and called them. They presented the portal to them and tried to close a contract about a cost free test entry or a “premium entry” on the portal. During the call, the call centre staff asked for data related to the customer and their accommodation. Subsequently, the controller provided the new client with information and a confirmation via e-mail. Persons who said they did not want to be contacted anymore were blacklisted. Following 20 data protection complaints, the Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) got to know about the business practices of the controller and, in particular, that a client will receive more calls after opting for the cost-free test ad on the portal. The DPA then conducted an official hearing of the controller. After the hearing, the Saxony-Anhalt DPA ordered the controller under Article 58(2)(f) GDPR to refrain from the processing of phone numbers and other personal data for the purpose of advertisement if these phone numbers are related to an identifiable natural person. This order included an exception for cases in which the person had either consented to the processing of their data or concrete facts indicate that the person had a factual interest in an advertisement entry on the controller’s page and is awaiting the call or at least would react positively to the call. Furthermore, it ordered the controller under Article 58(2)(g) GDPR to delete all personal data that could not be processed anymore under the aforementioned order. In addition, the DPA ordered the controller under Article 58(1)(a) GDPR to demonstrate to the DPA the compliance with the orders by showing which measures were taken. In case of non-compliance the DPA threatened an administrative fine. The controller appealed this order before the Administrative Court Magdeburg (Verwaltungsgericht Magdeburg – VG Magdeburg). The court dismissed the controller’s appeal. The only possible legal ground for the processing of personal data in this case is Article 6(1)(f) GDPR. But in this case the processing cannot be based on Article 6(1)(f) GDPR. The court held that cold calling might fall out of the scope of application of Article 6(1)(f) GDPR because Article 13(3) of the Directive 2002/58/EC (ePrivacy Directive) in conjunction with [https://dejure.org/gesetze/UWG/7.html#Abs2:Nr1 § 7(2)(1) German law against unfair competition (Gesetz gegen den unlauteren Wettbewerb - UWG)] could be lex specialis. § 7(2)(1) UWG states that advertising by means of a telephone call made to a consumer without his or her prior express consent, or made to another market participant without at least the latter’s presumed consent constitutes an unacceptable nuisance to a market participant and is illegal. However, the court’s decision does not depend on this question since the processing of personal data in this case also fails the balancing test under Article 6(1)(f) GDPR. This is due to the fact that the processing of phone numbers for cold calling purposes fails to match the criteria of § 7(2)(1) UWG which can be taken into consideration. The court dismissed the controller’s argument that German competition law and the GDPR had different purposes and therefore, the DPA should not enforce competition law through the application of Data protection law. The court argued that an overall view would lead to the conclusion that it the cold calling was a uniform process in a way that the processing of personal data has the purpose of illegal cold calling. Therefore, the controller cannot argue that the DPA was not competent to enforce competition law.