With reference to EU Directives 95/46 and 2002/58, the court was asked to provide a preliminary ruling as to whether “the consent referred to in those provisions is validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent”. Additionally, the court was asked to consider EU Regulation 2016/679, (the ‘GDPR’), on a ratione temporis basis, as the German Court previously stated that it may be applicable to the main proceedings.
Recital 17 of Directive 2002/58, provides examples of a user’s consent being validly given, for example, ‘by ticking a box when visiting an internet website’. EU Directive 95/46 Article 2(h) then specifies the user’s consent as ‘any freely given specific and informed indication of his wishes, and as per Article 7, the consent must be given unambiguously.’ In this instance the court determined that “only active behaviour on the part of the data subject with a view to giving his or her consent may fulfil that requirement.” After the entering into force of the GDPR, the data subject’s consent has been defined further in Article 6(1)(a) as requiring a ‘freely given, specific, informed and unambiguous” indication of the subject’s consent, and Recital 32 precludes “silence, pre-ticked boxes or inactivity” from constituting consent.
© 2019 Whitestone Chambers