By Decision of 11 November 2020 (C-61/19), the Court of Justice of the European Union (CJEU) specified the conditions applicable to obtain a GDPR compliant consent.
Indeed, the Court ruled that the data subjects’ consent to the processing of their personal data was not valid in the following cases:
where the controller (i.e., Orange România) pre-ticked the consent box referring to a clause contained in a contract and stating that the customer has consented to the collection and storage of their personal data (in this case, their identity document); or
where it was not clear as to whether individuals could refuse the processing operations without suffering any consequences on the possibility to conclude the service agreement; or
where the individuals’ freedom of choice could be affected by requiring the individuals to complete an additional form to refuse the processing of personal data
By a decision of 23 June 2020, the German Federal Supreme Court provisionally confirms the allegation of abuse of a dominant position by Facebook because its users were not given the choice over the level of personalisation of their Facebook experience, which entails the collection of data from sources outside the Facebook network (e.g. Instragram, internet browsing etc.).
The Court considered that Facebook practice may hinder the competition in the social network and online advertising market due to its dominant position and provisionally upheld the decision of the German Federal Cartel Office (“Bundeskartellamt”) prohibiting Facebook from processing personal data collected outside the Facebook environment without the users’ additional consent.
This decision is interesting as it shows that in certain cases a breach of GDPR provisions may also have consequences on competition law matters.
The Conseil d’État (i.e. The French Supreme Administrative Court) upholds, by a decision of 19 June 2020, the €50 million sanction imposed on Google by a decision of the CNIL of 21 January 2019. The Supreme Court confirms that: the
On May 5, 2020, the European Data Protection Board (EDPB) published a slightly updated version of the WP 29 (i.e. former EDPB) guidelines on the GDPR consent of April 10, 2018. The EDPB has provided further clarifications regarding: – The
Following its first letter sent to Microsoft in January 2017, the WP 29 (group of European data protection authorities) issued a second letter on February 15 in which it raises concerns as to the validity of user’s consent and the