{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-61-19","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-61-19)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:f21935b9f97ee2a09b8f3bff121846911494fbd6451f0380238e09a59ef74310","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-61-19","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"Front matter","paragraphs":["para_1","para_2","para_3","para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31"],"kind":"front_matter"},{"title":"Judgment","paragraphs":["para_32","para_33","para_34","para_35","para_36"],"kind":"assessment"},{"title":"Legal context","paragraphs":["para_37"],"kind":"legal_framework"},{"title":"EU law","paragraphs":["para_38"],"kind":"legal_framework"},{"title":"Directive 95/46","paragraphs":["para_39","para_40","para_41","para_42","para_43","para_44","para_45","para_46","para_47","para_48","para_49","para_50","para_51","para_52","para_53","para_54","para_55","para_56","para_57","para_58","para_59","para_60","para_61","para_62","para_63","para_64","para_65","para_66","para_67","para_68","para_69","para_70","para_71","para_72"],"kind":"legal_framework"},{"title":"Regulation 2016/679","paragraphs":["para_73","para_74","para_75","para_76","para_77","para_78","para_79","para_80","para_81","para_82","para_83","para_84","para_85","para_86","para_87","para_88","para_89","para_90","para_91","para_92","para_93","para_94","para_95","para_96","para_97","para_98","para_99","para_100","para_101","para_102","para_103","para_104","para_105","para_106","para_107","para_108","para_109","para_110","para_111","para_112","para_113","para_114","para_115","para_116","para_117","para_118","para_119","para_120","para_121","para_122","para_123"],"kind":"legal_framework"},{"title":"Romanian law","paragraphs":["para_124","para_125","para_126","para_127","para_128","para_129","para_130","para_131","para_132","para_133","para_134","para_135","para_136","para_137","para_138","para_139","para_140","para_141"],"kind":"legal_framework"},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":["para_142","para_143","para_144","para_145","para_146","para_147","para_148","para_149","para_150","para_151","para_152","para_153","para_154","para_155","para_156","para_157","para_158","para_159","para_160","para_161","para_162","para_163","para_164","para_165","para_166","para_167","para_168","para_169","para_170","para_171","para_172","para_173","para_174","para_175","para_176","para_177","para_178","para_179","para_180","para_181"],"kind":"facts"},{"title":"Consideration of the questions referred","paragraphs":["para_182","para_183","para_184","para_185","para_186","para_187","para_188","para_189","para_190","para_191","para_192","para_193","para_194","para_195","para_196","para_197","para_198","para_199","para_200","para_201","para_202","para_203","para_204","para_205","para_206","para_207","para_208","para_209","para_210","para_211","para_212","para_213","para_214","para_215","para_216","para_217","para_218","para_219","para_220","para_221","para_222","para_223","para_224","para_225","para_226","para_227","para_228","para_229","para_230","para_231","para_232","para_233","para_234","para_235","para_236","para_237","para_238"],"kind":"questions"},{"title":"Costs","paragraphs":["para_239","para_240","para_241"],"kind":"costs"},{"title":"On those grounds, the Court (Second Chamber) hereby rules:","paragraphs":["para_242","para_243","para_244","para_245","para_246","para_247","para_248","para_249","para_250","para_251"],"kind":"operative"}],"paragraphs":[{"text":"62019CJ0061","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Second Chamber)","paragraph_id":"para_2"},{"text":"11 November 2020 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Directive 95/46/EC – Article 2(h) and Article 7(a) – Regulation (EU) 2016/679 – Article 4(11) and Article 6(1)(a) – Processing of personal data and protection of private life – Collection and storage of the copies of identity documents by a provider of mobile te …","paragraph_id":"para_4"},{"text":"In Case C‑61/19,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Tribunalul Bucureşti (Regional Court of Bucharest, Romania), made by decision of 14 November 2018, received at the Court on 29 January 2019, in the proceedings","paragraph_id":"para_6"},{"text":"Orange România SA","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP),","paragraph_id":"para_9"},{"text":"THE COURT (Second Chamber),","paragraph_id":"para_10"},{"text":"composed of A. Arabadjiev, President of the Chamber, T. von Danwitz (Rapporteur) and P.G. Xuereb, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: M. Szpunar,","paragraph_id":"para_12"},{"text":"Registrar: D. Dittert, Head of Unit,","paragraph_id":"para_13"},{"text":"having regard to the written procedure and further to the hearing on 11 December 2019,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"Orange România SA, by D.-D. Dascălu, A.-M. Iordache, and I. Buga , avocaţi,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), by A.G. Opre and I. Ilie, acting as Agents,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the Romanian Government, initially by E. Gane, O.-C. Ichim, L. Liţu and C.-R. Canţăr, and subsequently by E. Gane, O.-C. Ichim and L. Liţu, acting as Agents,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Italian Government, by G. Palmieri, acting as Agent, and by M. Russo, avvocato dello Stato,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Austrian Government, initially by J. Schmoll and G. Hesse, and subsequently by J. Schmoll, acting as Agents,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the Portuguese Government, by L. Inez Fernandes, P. Barros da Costa, L. Medeiros and I. Oliveira, acting as Agents,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the European Commission, by H. Kranenborg, D. Nardi and L. Nicolae, acting as Agents,","paragraph_id":"para_29"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 4 March 2020,","paragraph_id":"para_30"},{"text":"gives the following","paragraph_id":"para_31"},{"text":"Judgment","paragraph_id":"para_32"},{"text":"1","paragraph_id":"para_33"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 2 …","paragraph_id":"para_34","court_paragraph":1},{"text":"2","paragraph_id":"para_35"},{"text":"The request has been made in proceedings between Orange România SA and the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (the National Authority for the Supervision of Personal Data Processing, Romania), concerning an action for annulment of a decision by …","paragraph_id":"para_36","court_paragraph":2},{"text":"Legal context","paragraph_id":"para_37"},{"text":"EU law","paragraph_id":"para_38"},{"text":"Directive 95/46","paragraph_id":"para_39"},{"text":"3","paragraph_id":"para_40"},{"text":"Recital 38 of Directive 95/46 provides that, ‘if the processing of data is to be fair, the data subject must be in a position to learn of the existence of a processing operation and, where data are collected from him, must be given accurate and full information, bearing in mind the circumstances of the collection’.","paragraph_id":"para_41","court_paragraph":3},{"text":"4","paragraph_id":"para_42"},{"text":"Article 2(h) of that directive provides that, for the purposes of the directive:","paragraph_id":"para_43","court_paragraph":4},{"text":"‘“the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’","paragraph_id":"para_44"},{"text":"5","paragraph_id":"para_45"},{"text":"Article 6 of that directive states:","paragraph_id":"para_46","court_paragraph":5},{"text":"‘1.   Member States shall provide that personal data must be:","paragraph_id":"para_47"},{"text":"(a)","paragraph_id":"para_48"},{"text":"processed fairly and lawfully;","paragraph_id":"para_49"},{"text":"…","paragraph_id":"para_50"},{"text":"2.   It shall be for the controller to ensure that paragraph 1 is complied with.’","paragraph_id":"para_51"},{"text":"6","paragraph_id":"para_52"},{"text":"As set out in Article 7(a) of Directive 95/46:","paragraph_id":"para_53","court_paragraph":6},{"text":"‘Member States shall provide that personal data may be processed only if:","paragraph_id":"para_54"},{"text":"(a)","paragraph_id":"para_55"},{"text":"the data subject has unambiguously given his consent …’","paragraph_id":"para_56"},{"text":"7","paragraph_id":"para_57"},{"text":"Article 10 of that directive reads as follows:","paragraph_id":"para_58","court_paragraph":7},{"text":"‘Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:","paragraph_id":"para_59"},{"text":"(a)","paragraph_id":"para_60"},{"text":"the identity of the controller and of his representative, if any;","paragraph_id":"para_61"},{"text":"(b)","paragraph_id":"para_62"},{"text":"the purposes of the processing for which the data are intended;","paragraph_id":"para_63"},{"text":"(c)","paragraph_id":"para_64"},{"text":"any further information such as","paragraph_id":"para_65"},{"text":"–","paragraph_id":"para_66"},{"text":"the recipients or categories of recipients of the data,","paragraph_id":"para_67"},{"text":"–","paragraph_id":"para_68"},{"text":"whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply,","paragraph_id":"para_69"},{"text":"–","paragraph_id":"para_70"},{"text":"the existence of the right of access to and the right to rectify the data concerning him","paragraph_id":"para_71"},{"text":"in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject.’","paragraph_id":"para_72"},{"text":"Regulation 2016/679","paragraph_id":"para_73"},{"text":"8","paragraph_id":"para_74"},{"text":"Recitals 32 and 42 of Regulation 2016/679 state:","paragraph_id":"para_75","court_paragraph":8},{"text":"‘(32)","paragraph_id":"para_76"},{"text":"Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement …","paragraph_id":"para_77"},{"text":"…","paragraph_id":"para_78"},{"text":"(42)","paragraph_id":"para_79"},{"text":"Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware …","paragraph_id":"para_80"},{"text":"9","paragraph_id":"para_81"},{"text":"Article 4(11) of that regulation provides:","paragraph_id":"para_82","court_paragraph":9},{"text":"‘“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.’","paragraph_id":"para_83"},{"text":"10","paragraph_id":"para_84"},{"text":"Article 5 of that regulation provides:","paragraph_id":"para_85","court_paragraph":10},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_86"},{"text":"(a)","paragraph_id":"para_87"},{"text":"processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_88"},{"text":"…","paragraph_id":"para_89"},{"text":"2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_90"},{"text":"11","paragraph_id":"para_91"},{"text":"In accordance with Article 6(1)(a) of Regulation 2016/679:","paragraph_id":"para_92","court_paragraph":11},{"text":"‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_93"},{"text":"(a)","paragraph_id":"para_94"},{"text":"the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_95"},{"text":"…’","paragraph_id":"para_96"},{"text":"12","paragraph_id":"para_97"},{"text":"Article 7(1), (2) and (4) of Regulation 2016/679 is worded as follows:","paragraph_id":"para_98","court_paragraph":12},{"text":"‘1.   Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.","paragraph_id":"para_99"},{"text":"2.   If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.","paragraph_id":"para_100"},{"text":"…","paragraph_id":"para_101"},{"text":"4.   When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.’","paragraph_id":"para_102"},{"text":"13","paragraph_id":"para_103"},{"text":"Article 13(1) and (2) states:","paragraph_id":"para_104","court_paragraph":13},{"text":"‘1.   Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:","paragraph_id":"para_105"},{"text":"(a)","paragraph_id":"para_106"},{"text":"the identity and the contact details of the controller and, where applicable, of the controller’s representative;","paragraph_id":"para_107"},{"text":"…","paragraph_id":"para_108"},{"text":"(c)","paragraph_id":"para_109"},{"text":"the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;","paragraph_id":"para_110"},{"text":"…","paragraph_id":"para_111"},{"text":"2.   In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:","paragraph_id":"para_112"},{"text":"(a)","paragraph_id":"para_113"},{"text":"the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;","paragraph_id":"para_114"},{"text":"(b)","paragraph_id":"para_115"},{"text":"the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;","paragraph_id":"para_116"},{"text":"(c)","paragraph_id":"para_117"},{"text":"where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.’","paragraph_id":"para_118"},{"text":"14","paragraph_id":"para_119"},{"text":"Article 94(1) of Regulation 2016/679 provides:","paragraph_id":"para_120","court_paragraph":14},{"text":"‘Directive 95/46/EC is repealed with effect from 25 May 2018.’","paragraph_id":"para_121"},{"text":"15","paragraph_id":"para_122"},{"text":"Article 99(2) of Regulation 2016/679 provides that that regulation is to apply from 25 May 2018.","paragraph_id":"para_123","court_paragraph":15},{"text":"Romanian law","paragraph_id":"para_124"},{"text":"16","paragraph_id":"para_125"},{"text":"The legea nr. 677/2001 pentru protecția persoanelor cu privire la prelucrarea datelor cu caracter personal și libera circulație a acestor date (Law No 677/2001 on the protection of persons with regard to the processing of personal data and on the free movement of such data) ( Monitorul Oficial al României , Part I, No 790 of 12 December 2001) is intended to transpose the provisions of Directive 95/46 into national law.","paragraph_id":"para_126","court_paragraph":16},{"text":"17","paragraph_id":"para_127"},{"text":"Article 5(1) of that law provides:","paragraph_id":"para_128","court_paragraph":17},{"text":"‘(1)   Any processing of personal data, except for the processing which refers to the categories mentioned in Article 7(1) and Articles 8 and 10, may be carried out only if the data subject has given his or her express and unambiguous consent for that processing.","paragraph_id":"para_129"},{"text":"…’","paragraph_id":"para_130"},{"text":"18","paragraph_id":"para_131"},{"text":"In accordance with Article 8 of that law:","paragraph_id":"para_132","court_paragraph":18},{"text":"‘(1)   The processing of an individual’s personal identification number or of other personal data having a generally applicable identification purpose may be carried out only if:","paragraph_id":"para_133"},{"text":"(a)","paragraph_id":"para_134"},{"text":"the data subject has expressly given his or her consent, or","paragraph_id":"para_135"},{"text":"(b)","paragraph_id":"para_136"},{"text":"the processing is expressly provided for by a provision of law.","paragraph_id":"para_137"},{"text":"(2)   The supervisory authority may also establish other cases in which the processing of the data referred to in paragraph 1 may be carried out, provided that adequate safeguards are in place to protect the rights of data subjects.’","paragraph_id":"para_138"},{"text":"19","paragraph_id":"para_139"},{"text":"Article 32 of Law 677/2001 is worded as follows:","paragraph_id":"para_140","court_paragraph":19},{"text":"‘The processing of personal data by a controller, or by a person mandated by him or her, in breach of Articles 4 to 10 or without due regard to the rights provided for in Articles 12 to 15 or in Article 17, shall constitute an administrative offence, unless it is carried out in such circumstances as to constitute a criminal offence, and shall be penalised by a fine of between RON [1000] and RON [25000].’","paragraph_id":"para_141"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_142"},{"text":"20","paragraph_id":"para_143"},{"text":"Orange România is a provider of mobile telecommunications services on the Romanian market.","paragraph_id":"para_144","court_paragraph":20},{"text":"21","paragraph_id":"para_145"},{"text":"By decision of 28 March 2018, the ANSPDCP imposed a fine on Orange România for storing copies of customers’ identity documents without demonstrating that those customers had given their valid consent, and also required it to destroy those copies.","paragraph_id":"para_146","court_paragraph":21},{"text":"22","paragraph_id":"para_147"},{"text":"In that decision, the ANSPDCP stated that between 1 and 26 March 2018, Orange România had concluded contracts in writing for the provision of mobile telecommunications services with individuals and that copies of those persons’ identity documents were annexed to those contracts. According to the ANS …","paragraph_id":"para_148","court_paragraph":22},{"text":"23","paragraph_id":"para_149"},{"text":"The relevant clauses of the contracts in question read as follows:","paragraph_id":"para_150","court_paragraph":23},{"text":"‘– The customer states that:","paragraph_id":"para_151"},{"text":"(i)","paragraph_id":"para_152"},{"text":"he or she has been informed, prior to concluding the contract, of the chosen tariff plan, the applicable tariffs, the minimum duration of the contract, the conditions for its termination, the conditions for accessing and using the services, including service coverage areas, …;","paragraph_id":"para_153"},{"text":"(ii)","paragraph_id":"para_154"},{"text":"Orange România has provided the customer with all the necessary information to enable him or her to give his or her unvitiated, express, free and specific consent to the conclusion and express acceptance of the contract, including all the contractual documentation, the General Terms and Conditions for using Orange’s services and the Brochure of Tariffs and Services;","paragraph_id":"para_155"},{"text":"(iii)","paragraph_id":"para_156"},{"text":"he or she has been informed of, and has consented to, the following:","paragraph_id":"para_157"},{"text":"–","paragraph_id":"para_158"},{"text":"the processing of personal data for the purposes referred to in Article 1.15 of the General Terms and Conditions for using Orange’s services;","paragraph_id":"para_159"},{"text":"–","paragraph_id":"para_160"},{"text":"the storage of copies of documents containing personal data for identification purposes;","paragraph_id":"para_161"},{"text":"–","paragraph_id":"para_162"},{"text":"the agreement for the processing of personal data (contact number and email address) for direct marketing purposes;","paragraph_id":"para_163"},{"text":"–","paragraph_id":"para_164"},{"text":"the agreement for the processing of personal data (contact number and email address) for market research purposes;","paragraph_id":"para_165"},{"text":"–","paragraph_id":"para_166"},{"text":"I have read and expressly agree to the storage of copies of documents containing personal data relating to state of health;","paragraph_id":"para_167"},{"text":"–","paragraph_id":"para_168"},{"text":"the data referred to in Article 1.15(10) of the General Terms and Conditions for Orange’s services are not included in subscriber information and subscriber directory services.’","paragraph_id":"para_169"},{"text":"24","paragraph_id":"para_170"},{"text":"Orange România brought an action against the decision of 28 March 2018 before the Tribunalul Bucureşti (Regional Court, Bucharest, Romania).","paragraph_id":"para_171","court_paragraph":24},{"text":"25","paragraph_id":"para_172"},{"text":"According to the findings of the referring court, there are both contracts in which a cross has been placed in the box for the clause relating to the storage of copies of documents with personal data for identification purposes and also contracts in which there is no such cross. That court explains …","paragraph_id":"para_173","court_paragraph":25},{"text":"26","paragraph_id":"para_174"},{"text":"The referring court raises the question whether, in those circumstances, the customers concerned may be regarded as having validly consented to the collection of their identity document and to copies of that document being annexed to the contracts. Furthermore, that court is uncertain whether the signing of a contract with a clause on the storage of copies of documents containing personal data for identification purposes can prove the existence of such consent.","paragraph_id":"para_175","court_paragraph":26},{"text":"27","paragraph_id":"para_176"},{"text":"In those circumstances the Tribunalul București (Regional Court, Bucharest) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_177","court_paragraph":27},{"text":"‘(1)","paragraph_id":"para_178"},{"text":"For the purposes of Article [2](h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as specific and informed?","paragraph_id":"para_179"},{"text":"(2)","paragraph_id":"para_180"},{"text":"For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as freely given?’","paragraph_id":"para_181"},{"text":"Consideration of the questions referred","paragraph_id":"para_182"},{"text":"28","paragraph_id":"para_183"},{"text":"As a preliminary matter, it is appropriate to determine the applicability of Directive 95/46 and Regulation 2016/679 to the facts at issue in the main proceedings.","paragraph_id":"para_184","court_paragraph":28},{"text":"29","paragraph_id":"para_185"},{"text":"Directive 95/46 was repealed with effect from 25 May 2018 and replaced by Regulation 2016/679, in accordance with Article 94(1) and Article 99(2) of that regulation.","paragraph_id":"para_186","court_paragraph":29},{"text":"30","paragraph_id":"para_187"},{"text":"Accordingly, as the decision of the ANSPDCP at issue in the main proceedings was adopted on 28 March 2018 and, therefore, before 25 May 2018, the referring court is fully entitled to find that Directive 95/46 applies ratione temporis to the main proceedings.","paragraph_id":"para_188","court_paragraph":30},{"text":"31","paragraph_id":"para_189"},{"text":"That being so, it is also apparent from the file before the Court that, by its decision, the ANSPDCP not only imposed a fine on Orange România, but also ordered it to destroy the copies of the identity documents at issue, and that the main proceedings also concern that latter order. As nothing in th …","paragraph_id":"para_190","court_paragraph":31},{"text":"32","paragraph_id":"para_191"},{"text":"In those circumstances, in order to enable the Court to provide useful answers to the questions submitted by the referring court, those questions must be answered on the basis of both Directive 95/46 and Regulation 2016/679 (see, by analogy, judgment of 1 October 2019, Planet49, C‑673/17 , EU:C:2019:801 , paragraph  43 ).","paragraph_id":"para_192","court_paragraph":32},{"text":"33","paragraph_id":"para_193"},{"text":"By its two questions referred for a preliminary ruling, which should be examined together, the referring court asks, in essence, whether Article 2(h) and Article 7(a) of Directive 95/46 and Article 4(11) and Article 6(1)(a) of Regulation 2016/679 must be interpreted as meaning that a contract for th …","paragraph_id":"para_194","court_paragraph":33},{"text":"34","paragraph_id":"para_195"},{"text":"In that regard, it should be borne in mind that Article 7 of Directive 95/46 and Article 6 of Regulation 2016/679 set out an exhaustive list of the cases in which the processing of personal data can be regarded as being lawful (see, regarding Article 7 of Directive 95/46, judgments of 19 October 201 …","paragraph_id":"para_196","court_paragraph":34},{"text":"35","paragraph_id":"para_197"},{"text":"As regards the requirements to which such consent is subject, Article 7(a) of Directive 95/46 provides that the data subject must have ‘unambiguously given his consent’, while Article 2(h) of that directive defines the term ‘consent’ as meaning ‘any freely given specific and informed indication of h …","paragraph_id":"para_198","court_paragraph":35},{"text":"36","paragraph_id":"para_199"},{"text":"That same requirement also operates in the context of Regulation 2016/679. Indeed, the wording of Article 4(11) of that regulation, which defines the ‘consent of the data subject’ for the purposes, inter alia, of Article 6(1)(a) of that regulation, appears even more stringent than Article 2(h) of Di …","paragraph_id":"para_200","court_paragraph":36},{"text":"37","paragraph_id":"para_201"},{"text":"In that regard, while recital 32 of that regulation states that consent could be given, inter alia, by ticking a box when visiting an internet website, on the contrary, it expressly excludes the possibility that ‘silence, pre-ticked boxes or inactivity’ constitute consent. As the Court has held, in …","paragraph_id":"para_202","court_paragraph":37},{"text":"38","paragraph_id":"para_203"},{"text":"Furthermore, Article 2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679 require a ‘specific’ indication of the data subject’s wishes in the sense that it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subject’s wishes for other purposes (see, regarding Article 2(h) of Directive 95/46, judgment of 1 October 2019, Planet49, C‑673/17 , EU:C:2019:801 , paragraph  58 ).","paragraph_id":"para_204","court_paragraph":38},{"text":"39","paragraph_id":"para_205"},{"text":"In that regard, the first sentence of Article 7(2) of that regulation states that if the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent is to be presented in a manner which is clearly distinguishable from the other m …","paragraph_id":"para_206","court_paragraph":39},{"text":"40","paragraph_id":"para_207"},{"text":"As regards the requirement arising from Article 2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679 that consent must be ‘informed’, that requirement implies, in accordance with Article 10 of that directive, read in the light of recital 38 thereof, and with Article 13 of that regulation …","paragraph_id":"para_208","court_paragraph":40},{"text":"41","paragraph_id":"para_209"},{"text":"Furthermore, as the Commission noted in its observations submitted to the Court, it is clear from the second indent of Article 10(c) of Directive 95/46 and from Article 13(2)(b) and (c) of Regulation 2016/679, read in the light of recital 42 of that regulation, that, in order to ensure that the data …","paragraph_id":"para_210","court_paragraph":41},{"text":"42","paragraph_id":"para_211"},{"text":"It is appropriate to add that under Article 6(1)(a) and (2) of Directive 95/46 and Article 5(1)(a) of Regulation 2016/679, the controller of personal data is required to ensure, inter alia, the lawfulness of the processing of those data and, as stated in Article 5(2) of that regulation, must be able …","paragraph_id":"para_212","court_paragraph":42},{"text":"43","paragraph_id":"para_213"},{"text":"In the present case, Orange România stated, in its observations to the Court, that, during the procedure for concluding the contracts at issue in the main proceedings, its sales agents informed the customers concerned, before concluding the contracts, inter alia, of the purposes of collecting and st …","paragraph_id":"para_214","court_paragraph":43},{"text":"44","paragraph_id":"para_215"},{"text":"In those circumstances, the request for a preliminary ruling essentially seeks to clarify whether the consent thus invoked as regards such processing of personal data may be established on the basis of the contractual clauses in those contracts.","paragraph_id":"para_216","court_paragraph":44},{"text":"45","paragraph_id":"para_217"},{"text":"In that regard, it is apparent from the information set out in that request that, although those contracts contain a clause stating that the customers concerned have been informed of, and have given their consent to, the storage of a copy of their identity document for identification purposes, the b …","paragraph_id":"para_218","court_paragraph":45},{"text":"46","paragraph_id":"para_219"},{"text":"Since, according to the information in the request for a preliminary ruling, the customers concerned do not appear to have themselves ticked the box relating to that clause, the mere fact that that box was ticked is not such as to establish a positive indication of those customers’ consent to a copy …","paragraph_id":"para_220","court_paragraph":46},{"text":"47","paragraph_id":"para_221"},{"text":"Furthermore, to the extent that the ticked clause relating to the processing of those data does not appear to have been presented in a form which clearly distinguishes it from the other contractual clauses, it is for that court to assess, in the light of the considerations in paragraph 34 above, whe …","paragraph_id":"para_222","court_paragraph":47},{"text":"48","paragraph_id":"para_223"},{"text":"Moreover, since the contractual clause at issue in the main proceedings merely states, without giving any further details, that storage of the copies of the identity cards is for identification purposes, it is for the referring court to ascertain whether the information provided to the data subjects …","paragraph_id":"para_224","court_paragraph":48},{"text":"49","paragraph_id":"para_225"},{"text":"It is also for the referring court to assess, in particular, whether the contractual terms at issue in the main proceedings were capable of misleading the data subject as to the possibility of concluding the contract notwithstanding a refusal to consent to the processing of his or her data, in the absence of specific details on that point, thereby calling into question the informed nature of the consent expressed by the signature.","paragraph_id":"para_226","court_paragraph":49},{"text":"50","paragraph_id":"para_227"},{"text":"Furthermore, as the Advocate General observed in point 60 of his Opinion, the free nature of that consent appears to be called into question by the fact that, if that consent is refused, Orange România, departing from the normal procedure for concluding the contract, required the customer concerned …","paragraph_id":"para_228","court_paragraph":50},{"text":"51","paragraph_id":"para_229"},{"text":"In any event, as is apparent from the considerations set out in paragraphs 35, 36 and 42 above, it is for Orange România, as the data controller, to establish that its customers have, by active behaviour, given their consent to the processing of their personal data, with the result that that company cannot require them actively to express their refusal.","paragraph_id":"para_230","court_paragraph":51},{"text":"52","paragraph_id":"para_231"},{"text":"In the light of the foregoing considerations, the answer to the questions referred is that Article 2(h) and Article 7(a) of Directive 95/46 and Article 4(11) and Article 6(1)(a) of Regulation 2016/679 must be interpreted as meaning that it is for the data controller to demonstrate that the data subj …","paragraph_id":"para_232","court_paragraph":52},{"text":"–","paragraph_id":"para_233"},{"text":"the box referring to that clause has been ticked by the data controller before the contract was signed, or where","paragraph_id":"para_234"},{"text":"–","paragraph_id":"para_235"},{"text":"the terms of that contract are capable of misleading the data subject as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data, or where","paragraph_id":"para_236"},{"text":"–","paragraph_id":"para_237"},{"text":"the freedom to choose to object to that collection and storage is unduly affected by that controller in requiring that the data subject, in order to refuse consent, must complete an additional form setting out that refusal.","paragraph_id":"para_238"},{"text":"Costs","paragraph_id":"para_239"},{"text":"53","paragraph_id":"para_240"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_241","court_paragraph":53},{"text":"On those grounds, the Court (Second Chamber) hereby rules:","paragraph_id":"para_242"},{"text":"Article 2(h) and Article 7(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Article 4(11) and Article 6(1)(a) of Regulation (EU) 2016/679 …","paragraph_id":"para_243"},{"text":"–","paragraph_id":"para_244"},{"text":"the box referring to that clause has been ticked by the data controller before the contract was signed, or where","paragraph_id":"para_245"},{"text":"–","paragraph_id":"para_246"},{"text":"the terms of that contract are capable of misleading the data subject as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data, or where","paragraph_id":"para_247"},{"text":"–","paragraph_id":"para_248"},{"text":"the freedom to choose to object to that collection and storage is unduly affected by that controller, in requiring that the data subject, in order to refuse consent, must complete an additional form setting out that refusal.","paragraph_id":"para_249"},{"text":"[Signatures]","paragraph_id":"para_250"},{"text":"(\n *1\n ) Language of the case: Romanian.","paragraph_id":"para_251"}],"operative_part":"On those grounds, the Court (Second Chamber) hereby rules:\n\nArticle 2(h) and Article 7(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and A …","word_count":5896,"cites":["C-673/17","C-582/14"],"cited_by":[],"sha256":"8511e83ed51fdeb9b92eb887f7c4268738da8353b6aa492849e2c4d836a5f693","source_url":"https://publications.europa.eu/resource/celex/62019CJ0061.ENG.xhtml.ECR_62019CJ0061_EN_01.html","fetched_at":"2026-10-03T01:03:14.244+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-61-19","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-61-19","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-61-19","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-61-19","verification":{"stored_sha256":"8511e83ed51fdeb9b92eb887f7c4268738da8353b6aa492849e2c4d836a5f693","recomputed_sha256":"8511e83ed51fdeb9b92eb887f7c4268738da8353b6aa492849e2c4d836a5f693","intact":true,"checked_at":"2026-10-15T07:35:23.873Z"}},"hash":"sha256:f21935b9f97ee2a09b8f3bff121846911494fbd6451f0380238e09a59ef74310","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T07:24:49","content_hash":"sha256:f21935b9f97ee2a09b8f3bff121846911494fbd6451f0380238e09a59ef74310","revalidate_after":"2026-10-15T08:35:24.464Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-61-19","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-61-19"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-61-19"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-61-19"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-61-19","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-af44b8bd86845a63c87647936611c69c","response_hash":"sha256:f21935b9f97ee2a09b8f3bff121846911494fbd6451f0380238e09a59ef74310"}},"freshness":{"freshness_class":"live","as_of":"2026-11-03T06:07:40.684Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-61-19&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":13957}}