The Court of Justice of the European Union confirmed the position of ANSPDCP

In the dispute pending before the Romanian courts, having as parties Orange România SA and Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), the Court of Justice of the European Union confirmed the position of ANSPDCP regarding the illegality of Orange Romania SA’s storage of identity documents of its clients, without their express consent on the occasion of concluding contracts for providing telecommunications services.

Thus, the Court stated that “a contract for the provision of telecommunications services which contains a clause stating that the data subject has been informed of, and has consented to, the collection and storage of a copy of his or her identity document for identification purposes is not such as to demonstrate that that person has validly given his or her consent to that collection and storage:

• where the box referring to that clause has been ticked by the data controller before the contract was signed or
• where the terms of that contract are capable of misleading the data subject as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data, or
• where the freedom to choose to object to that collection and storage is unduly affected by that controller, in that it requires that the data subject, in order to express his or her refusal to consent to such processing, must complete an additional form setting out that refusal.”

Regarding the above mention dispute, we state that the national supervisory authority, in the exercise of its investigation powers, sanctioned the controller Orange Romania SA on the 28^th of March 2018 with a fine of 10,000 lei.

The sanction was imposed to controller Orange Romania SA for the deed provided by Article 32 of Law no. 677/2001, in violation of Article 4 paragraph (1) letter c) and Article 8 of Law no. 677/2001, corroborated with Articles 2 and 6 of the Decision of ANSPDCP’s president no. 132/2001.

Thus, Orange Romania SA, by collecting and storing the copies of the identity documents, requested by electronic communications service contracts, has excessively processed personal data falling under Article 8 of Law no. 677/2001, without the express consent of the data subjects, express legal provisions of the approval of ANSPDCP.

Therefore, the sanction of fine was imposed to the controller and it was ordered that as soon as possible to take the measures for deleting/destroying the copies of identity documents of the natural persons with whom it concluded contracts for the provision of electronic communications services, collected and stored without having the express consent of the data subjects, without the processing being provided by a legal disposition or without the approval of ANSPDCP pursuant to Article 2 of Decision no. 132/2011.

Subsequently, the minutes by which the sanction of a fine was imposed was challenged in court by Orange Romania SA, on which occasion Orange Romania SA submitted to the Bucharest Tribunal a request to refer to the Court of Justice of European Union in order to issue a preliminary ruling.

The Bucharest Tribunal admitted the request formulated by Orange Romania SA regarding the notification of the Court of Justice of European Union in order to issue a preliminary ruling on the interpretation of Article 2 letter h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, ordering the suspension of the trial pending until the ruling of CJEU on the referral.

The dispute was the subject of Case C-61/19, pending before the Court of Justice of European Union, where the request was made by the Bucharest Tribunal.

The Court of Justice of European Union ruled on the 11^th of November 2020 on the preliminary questions asked by the Bucharest Tribunal, confirming the position of ANSPDCP.

In light of the above, the CJEU issued a press release which can be accessed at the following link: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-11/cp200137en.pdf.

Legal and Communication Department

ANSPDCP