Beware Cookie Law

Websites that use cookies to track users and their interactions will have to pay close attention to the recent case of Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV (the ‘Federation’) v Planet49 GmbH (‘Planet49’) Case C‑673/17, 1 October 2019, which clarifies the indication the user must provide as to their consent to the use of cookies.

Planet49 organised a promotional lottery accessed via a website. If users wished to take part in this competition, users were required to enter personal details such as their name and postcode on the website. The user was also presented with two boxes to check. The first box one was unchecked and required the user to check it to enter the competition, this would also allow certain sponsors and corporate partners to contact the user. The second box was pre-checked and if this approval were not removed it would allow multichannel retargeting company Remintrex to evaluate the user’s use and behaviour through the use of cookies.

With reference to EU Directives 95/46 and 2002/58, the court was asked to provide a preliminary ruling as to whether “the consent referred to in those provisions is validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent”. Additionally, the court was asked to consider EU Regulation 2016/679, (the ‘GDPR’), on a ratione temporis basis, as the German Court previously stated that it may be applicable to the main proceedings.

Recital 17 of Directive 2002/58, provides examples of a user’s consent being validly given, for example, ‘by ticking a box when visiting an internet website’. EU Directive 95/46 Article 2(h) then specifies the user’s consent as ‘any freely given specific and informed indication of his wishes, and as per Article 7, the consent must be given unambiguously.’ In this instance the court determined that “only active behaviour on the part of the data subject with a view to giving his or her consent may fulfil that requirement.” After the entering into force of the GDPR, the data subject’s consent has been defined further in Article 6(1)(a) as requiring a ‘freely given, specific, informed and unambiguous” indication of the subject’s consent, and Recital 32 precludes “silence, pre-ticked boxes or inactivity” from constituting consent.

As a result of the court’s ruling, a website using a pre-checked box to act as consent to the use of cookies on the user’s terminal before 25 May 2018 would be in breach of EU Directive 95/46; as of 25 May 2018, Directive 95/46 has been repealed and replaced by the GDPR meaning that any breach after this date would be a breach of the GDPR rather than the Directive.

Interestingly, what the court was not asked to give an opinion on was whether the user’s consent was ‘freely given’ as set out by Article 2(h) of EU Directive 95/46, and Articles 4(11) and 6(1)(a) of the GDPR. The very important question still remains as to whether consent is freely given if the user must allow the use of cookies to enter the competition, or in a wider context, to enter a website.

© 2019 Whitestone Chambers

Flybe to be rebranded as Virgin Connect

After 40 years as the largest independent regional airline in Europe, Flybe has been acquired by the Connect Airways consortium. The Connect Airways consortium was created in December 2018 and consists of 40% ownership by Cyprus Capital, 30% by the Stobart Group, and 30% by Virgin Atlantic Limited.

The proposed merger of the consortium received approval from the European Commission on 5 July 2019 [1] on condition that full compliance is met by Connect Airways as to the commitments [2] that it offered, to ensure that it complies fully with competition law. Following the merger in July 2019, Flybe was acquired by Connect Airways and in the near future, the Flybe name will be changed to ‘Virgin Connect’. Switching from the current purple colour schemes, Flybe’s fleet of 76 aircrafts will be rebranded to match the distinctive red of the Virgin Group companies.

Based in Exeter, and with hubs at Birmingham and Manchester airport, Flybe currently carries 8 million passengers per year between 81 airports throughout the UK and the rest of Europe. Flybe has over 210 routes across 15 countries, and a number of codeshares permitting connections to long-haul flights from several airports including London Heathrow, Paris CDG and Amsterdam. These capabilities will be used by Virgin Connect to build upon the existing Virgin brand, and to offer a wider range of services.

The CEO of the newly branded Virgin Connect, Mark Anderson said: “We are hugely excited by this milestone in our airline’s 40-year history. We will remain true to our heritage and reason for being, which is offering essential regional connectivity to local communities. “At its heart, Virgin Connect will be passionately focused on becoming Europe’s most loved and successful regional airline. It will offer travel that is simple and convenient with the personal touch. Our customers will naturally expect the same exceptional travel experience as they do with other Virgin-related brands. Whatever their reason for flying, we want our customers to feel loved and know we will always put their needs first in every decision we take.

Customers are advised that their bookings will not be affected and that they may continue to visit to book flights, check in and manage their booking. For those passengers concerned about Brexit, they can have their fears alleviated. In place is EU Regulation 2019/502 that provides for common rules ensuring basic air connectivity with regards to Brexit, allowing Virgin Connect to fly to European destinations until 24 October 2020.



© 2019 Whitestone Chambers