Pre-ticked box constitutes a violation of the GDPR

The Court of Justice of the European Union (EuGH) had to clarify whether consent expressed through a standard pre-ticked box is permissible or constitutes a GDPR violation.

A Romanian telecommunications provider was fined by the competent national authority responsible for monitoring the processing of personal data. Reason for the fine: the telecommunications provider had retained copies of its customers' identity documents without their express consent.

The provider had concluded contracts with customers that required data protection consent. Specifically, it concerned the collection and retention of a copy of the customer's identity document. The box relating to this clause was pre-ticked by default.

The telecommunications provider challenged the fine in court. The Regional Court (LG) in Bucharest (Romania) subsequently asked the EuGH to clarify the conditions under which customer consent to the processing of personal data can be considered GDPR-compliant.

Pre-ticked box is a violation of the GDPR

The EuGH (Urt. v. 11.11.2020, Az. C-61/19) established that in the present case there was no lawful data processing where a cross had been pre-set. The EuGH made clear that consent of the data subject must be freely given, specific, informed and unambiguous.

Such a declaration must be provided in intelligible and easily accessible form and formulated in clear and plain language. This applies in particular where consent is a statement of consent pre-formulated by the controller responsible for the processing of personal data.

Valid consent fails if the data subject, for example, remains inactive or is confronted with a box that is already ticked. As the controller, the telecommunications provider should have demonstrated the lawfulness of processing that data. Thus, it should have demonstrated the existence of valid consent from its customers – which, however, it failed to do.

For the mere fact that the box in question was ticked is not capable of demonstrating a positive statement of consent from the customers.

Conclusion

Consent under the GDPR must be freely given, specific, informed and unambiguous. A statement of consent in the form of a box that is pre-ticked by default does not satisfy these principles.