CASE C-673/17

PLANET49 GMBH
V
BUNDESVERBAND DER VERBRAUCHERZENTRALEN
UND VERBRAUCHERVERBÄNDE –
VERBRAUCHERZENTRALE BUNDESVERBAND E.V.
(FEDERAL ASSOCIATION OF CONSUMER
ORGANIZATIONS AND CONSUMER ASSOCIATION)
• The case contains fundamental questions of the Union's data protection law: exactly what
requirements apply when it comes to informed, voluntary consent? Is there a difference as
to whether it is (only) about processing personal data or about setting up and accessing
cookies? What legal instruments apply?
THE FACTUAL CONTEXT OF THE REQUEST FOR A PRELIMINARY
RULING BY THE FEDERAL SUPREME COURT OF GERMANY

On 24 September 2013, Planet49, online gaming company, organised a promotional lottery

on the website. In order to participate, online users had to type or remove a check mark
from two selection fields before they could click on the 'participation link'

The first check mark was the consent to be sent to them by various companies

The second check mark was consent to have cookies installed on their computer
• Participation in the prize draw is possible only after at least the first field is marked with a
check mark
SPONSORS AND PARTNERS

An electronic link to the word "sponsors and partners" leads to a list of 57 companies, the
commercial sector to be advertised and the methods of communication to be used for
advertising (e-mail, mail or telephone)

Next to each company was a 'cancel subscription' link that decides not to give the sponsor
consent to advertising
• The minimum number of sponsors to whom consent must be given is 30
 COOKIES

Small files that the browser you use are targeted to your hard drive and where certain data is transmitted
that allows for user-friendly advertising

They assign you an ID number that recognizes that you have just visited a particular website, demonstrated
product interest, and made a business transaction

Subsequently, Planet49 GmbH may determine, on the basis of consent, that promotional emails are sent to
you that take into account your interests expressed on the advertising partner's website. Of course, after
you withdraw this consent, you will no longer receive promotional emails.

Data is used exclusively for the purpose of advertising partners' products

Cookies cannot run any programs or transmit any viruses

• Consent can be withdrawn by sending the e-mail address to Planeta49
LEGAL FRAMEWORK

UNION LAW

Directive 95/46

Directive 2002/58/EC

Directive 2009/136/EC

Regulation 2016/679

GERMAN LAW

German Civil Code

Anti-Unfair Competition Law

Telemedia Law
• Federal Data Protection Law
PROCEDURE AND QUESTIONS REFERRED FOR A
PRELIMINARY RULING
Appellant in the main proceedings, Bundesverband

It states that the declarations of consent used by Planet49 did not meet the requirements laid
down in articles of the German Civil Code, the Anti-Unfair Competition Act and the
Telemedia Act
• The letter of notice sent before the opening of the court proceedings had no effect
The Bundesverband is proceedings before the Frankfurt Court of Justice, requiring Planet49
to stop using these statements and to order it to pay €214 plus interest

Landgericht Frankfurt am Main (Frankfurt-am Main) accepted some requests, while the rest
of the action was partially rejected. A cassation complaint has been lodged to the Federal
Supreme Courte
• The Federal Supreme Court referred the following questions to the Court:
DOES IT CONSTITUTE A VALID CONSENT WITHIN THE MEANING OF ARTICLE 5(3) AND
ARTICLE 2(F) OF DIRECTIVE [2002/58], READ IN CONJUNCTION WITH ARTICLE 2(H) OF
DIRECTIVE [95/46], IF THE STORAGE OF INFORMATION, OR ACCESS TO INFORMATION
ALREADY STORED IN THE USER’S TERMINAL EQUIPMENT, IS PERMITTED BY WAY OF A PRE-
CHECKED CHECKBOX WHICH THE USER MUST DESELECT TO REFUSE HIS OR HER CONSENT

Article 3(3) of that Directive, entitled 'Confidentiality of communications', provides:

'Member States shall ensure that the use of electronic communications networks to store information or to access
information stored in the terminal equipment of a subscriber or user is permitted only provided that clear and
comprehensive information is provided to the subscriber or user in accordance with Directive 95/46/EC, inter alia, on
the purpose of processing and where the data controller offers him the right to refuse such processing. This shall not
prevent the technical storage or access solely for the purpose of carrying out or facilitating the transmission of
communications over an electronic communications network or where it is strictly necessary to provide an information
society service expressly requested by the subscriber or user.'
Member States must ensure that the storage of data or the establishment of access to already stored data on the user's
terminal equipment is permitted only provided that the user has given his or her consent, having been informed
exhaustively and understandably in accordance with Directive 95/46 of the purpose of the processing.
although that provision expressly provides that the user has had to "give his consent" to the
placement and view of cookies on his terminal equipment, it does not, on the contrary,
contain any indication as to how that consent should be given.
•  it follows that the user may give consent within the meaning of that directive in any
appropriate manner enabling him to freely indicate specific and informed indications of
his or her wishes, including 'ticking when visiting a website on the Internet'.
Article 2 – paragraph 1 Directive 95/46, entitled 'Definitions', provides:

consent of the data subject' means any voluntary, specific and informed declaration of will giving the data subject his or
her consent to the processing of personal data relating to him or her.'

 the requirement of a 'declaration' of the will of the data subject clearly indicates active rather than passive action.
However, consent given to a field marked in advance by a check mark does not include the active action of the website
user.
•   In that regard, it is practically impossible to objectively determine whether the user of the website actually gave consent
to the processing of his personal data by failing to remove the check mark in advance of it, and in any event whether he
was informed at the time of that consent. It cannot be excluded that that user did not read the information provided next
to the check mark or that the field was not noticed before continuing his activity on the website he visits.
the declaration of will must be 'specific', in the sense that it must relate specifically to the
processing of the data concerned and that its existence cannot be concluded on the basis of a
declaration of will which has a different objective
• In the present case, contrary to The Planet49's assertions, the fact that the user activated
the button to participate in the prize draw organised by that company cannot therefore be
sufficient to conclude that the user has duly given consent to the setting of cookies
CONCLUSION

•  Following all the above considerations, it must be answered first that the consent provided for in those provisions is
not validly given if the storage of information or access to information already stored on the terminal equipment of
the website user, by means of cookies, permits a field that is marked in advance by a check mark, which the user
must remove in order to refuse to give his consent.
• Second and more importantly, participating in an online lottery and giving consent to set cookies cannot be part of
the same action. And that's exactly what was the case in this case. The user only had to click once, on the
participation link, to participate in the lottery. This would give you consent to set cookies. Thus, the user
simultaneously expressed two intentions (participation in the lottery and consent to set cookies). It should not have
been allowed to be done with one click, on the participation link. In doing so, it appears that the granting of consent
for cookies was of an incidental nature, in the sense that it was not carried out by a separate action. In other words,
moving/typing a check mark in the cookie field acts as a preparatory action in relation to the final and legally
binding click on the participation link.
 FOR THE PURPOSES OF THE APPLICATION OF ARTICLE
5(3) AND OF ARTICLE 2(F) OF DIRECTIVE [2002/58] READ IN
CONJUNCTION WITH ARTICLE 2(H) OF DIRECTIVE [95/46],
DOES IT MAKE A DIFFERENCE WHETHER THE
INFORMATION STORED OR ACCESSED CONSTITUTES
PERSONAL DATA?

 it is clear from the order for reference that the setting of the cookies at issue in the main proceedings
contributes to the processing of personal data
• it does not matter whether the data or data accessed is personal data. Article 5 refers to 'storing
data or establishing access to already stored data' . It is clear that such data have a private aspect,
irrespective of whether they constitute 'personal data' within the meaning of Article 4(1) of
Regulation (EC) No 1303/2009. Regulation 2016/679 or not. Article 5(3) Directive 2002/58 is
intended to protect the user from encroaching on their privacy, irrespective of whether that relates
to personal or other data.
 WHAT INFORMATION DOES THE SERVICE PROVIDER HAVE TO GIVE WITHIN THE SCOPE OF
THE PROVISION OF CLEAR AND COMPREHENSIVE INFORMATION TO THE USER THAT HAS TO
BE UNDERTAKEN IN ACCORDANCE WITH ARTICLE 5(3) OF DIRECTIVE [2002/58]? DOES THIS
INCLUDE THE DURATION OF THE OPERATION OF THE COOKIES AND THE QUESTION OF
WHETHER THIRD PARTIES ARE GIVEN ACCESS TO THE COOKIES?’

 Article 5(3) of Regulation (EU) No 1303/2013. Directive 2002/58 requires that the beneficiary must
give his or her consent, having 'in accordance with Directive [95/46]' been exhaustively and
understandably informed, inter alia, of the purpose of the processing
• comprehensive and comprehensible information should enable the user to easily understand the
consequences of possible consent and ensure that it is given with all the facts at its disposal. This
information must be easily understood and detailed enough to enable the user to understand how
cookies work
COOKIE DURATION INFORMATION

the duration of cookies is one of the elements of the information consent requirement, which
means that service providers "should always inform subscribers about the types of data they
process and the purpose and duration of that processing

In addition to having to examine what data each cookie contains and whether it is linked to any
other user data, service providers must also take into account the duration of cookies and whether
that duration is appropriate for the purpose of cookies
• The duration of cookies is related to explicit requests regarding informed consent relating to the
quality of the information and the ability of users to access them. This information is essential to
enable individuals to make informed decisions before processing
INFORMATION ON THIRD-PARTY ACCESS

• in order to ensure that the notification is exhaustive and understandable, the user must be
explicitly notified whether or not third parties have access to cookies. If they have it, their
identity must be stated.  As the Bundesverband correctly points out, it is necessary to
ensure that any consent is informed.
 COURT DECISION
• On those grounds, the Court (Grand Chamber) hereby rules:

• 1. Article 2(f) and of Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the
processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic
communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in
conjunction with Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and on the free movement of such data and Article 4(11) and Article 6(1)(a) of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard
to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection
Regulation), must be interpreted as meaning that the consent referred to in those provisions is not validly constituted if, in the form of
cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a
pre-checked checkbox which the user must deselect to refuse his or her consent.

• 2. Article 2(f) and Article 5(3) of Directive 2002/58, as amended by Directive 2009/136, read in conjunction with Article 2(h) of
Directive 95/46 and Article 4(11) and Article 6(1)(a) of Regulation 2016/679, are not to be interpreted differently according to whether or
not the information stored or accessed on a website user’s terminal equipment is personal data within the meaning of Directive 95/46 and
Regulation 2016/679.

• 3. Article 5(3) of Directive 2002/58, as amended by Directive 2009/136, must be interpreted as meaning that the information that the
service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have
access to those cookies
THANK YOU 
Laura Pašić