Cookies e consentimento

Alegações do Advogado Geral Szpunar de 21 de março de 2019 (C-673/17)

Conclusões muito relevantes. Espera-se, agora, a decisão do TJUE

Planet49 GmbH

vs

Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.

1. In order to participate in a lottery organised by Planet49, an internet user was confronted with two checkboxes which had to be clicked or unclicked before he could hit the ‘participation button’. One of the checkboxes required the user to accept being contacted by a range of firms for promotional offers, another checkbox required the user to consent to cookies being installed on his computer. These are, in a nutshell, the facts of the present order for reference from the Bundesgerichtshof (Federal Court of Justice, Germany).

2. Beneath these seemingly benign facts lie fundamental issues of EU data protection law: what precisely are the requirements of informed consent which is to be freely given? Is there a difference as regards the processing of personal data (only) and the setting of and access to cookies? Which legal instruments are applicable?

3. In this Opinion I shall argue that, as regards the current case, the requirements for giving consent are the same under Directive 95/46/EC (2) and Regulation (EU) 2016/679 (3) and that there is, in the case at issue, no difference whether we are dealing with the general question of processing of personal data or the more particular one of storing of and gaining access to information by way of cookies.

Conclusões

(1) There is no valid consent within the meaning of Articles 5(3) and 2(f) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), read in conjunction with Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data in a situation such as that of the main proceedings where the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his consent and where consent is given not separately but at the same time as confirmation in the participation in an online lottery.

(2) The same goes for the interpretation of Articles 5(3) and 2(f) of Directive 2002/58, read in conjunction with Article 4, point 11, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation).

(3) For the purposes of the application of Articles 5(3) and 2(f) of Directive 2002/58 in conjunction with Article 2(h) of Directive 95/46, it makes no difference whether the information stored or accessed constitutes personal data.

(4) The clear and comprehensive information a service provider has to give to a user, under Article 5(3) of Directive 2002/58, includes the duration of the operation of the cookies and the question of whether third parties are given access to the cookies or not.