Active and Separate Consent
In his opinion, the AG discussed the notion of valid consent within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereafter the "GDPR") and Directive 95/46/EC which was repealed by the GDPR, as well as under the ePrivacy Directive (Directive 2002/58/EC). After recalling the need for an active and separate consent of the data subject which has to be freely given on the basis of clear and comprehensive information, the AG inferred that permission for the installation of cookies by way of a pre-ticked checkbox does not constitute valid consent under EU law.
On the other hand, consent must be 'separate' and, as a result, the act that a user pursues (i.e., participation in the lottery), and the permission of cookies should not form part of the same act, (i.e., hitting the "participation" button). Rather, two distinct expressions of intent must be made without one being ancillary to the other.
Turning to the checkbox dealing with the processing of personal data for the purposes of marketing communication, the AG observed that a separate click button would have better guaranteed the existence of a separate consent. Furthermore, he discussed the "prohibition on bundling" under Article 7(4) of the GDPR. This rule requires any assessment as to whether permission is freely given to take into account whether the performance of a contract is made conditional on consent to the processing of personal data not necessary for the purposes of contract performance. In the case at hand, it was not clear whether a user had to consent to receiving marketing materials in order to participate in the lottery. In the AG's view, the "marketing checkbox" appeared to be a necessary condition for participation in the lottery.
Clear and Comprehensive Information
With respect to the question concerning the scope of the obligation of providers to give clear and comprehensive information to the data subject, the AG indicated that the user should be put in a position to learn easily about the consequences of any consent he or she might give. The information provided must therefore be "clearly comprehensible and not be subject to ambiguity or interpretation". Moreover, it has to "enable the user to comprehend the functioning of the cookies actually resorted to". Consequently, clarity about the time period for storage and whether or not third parties have access to the data should exist as ingredients of the informed consent. In the event that third parties may access the information, their identity must be disclosed. In addition, users must be aware of the types of processed data and the purposes for which this is done.
While not binding on the Court, the ECJ usually follows the AG's opinion. Its judgment is expected to be handed down still in 2019.
In addition, the AG's opinion may have implications on the discussions concerning the proposed ePrivacy Regulation which will update the ePrivacy Directive and complement the GDPR with specific rules on cookies.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.