Increased attention has been devoted in recent days to the judgement of the Court of Justice of the EU in the above-mentioned case dated 1/10/2019, which addressed the issue of storing cookies. In this legal circular, we therefore summarise for internet traders the conclusions reached by the court in this decision.
The interpretation provided of Article 5(3) of the Directive on privacy and electronic communications will have at this moment rather limited significance in the Czech Republic, due to the current incorrect implementation in Czech law. Specifically, this concerns the provision of Section 89(3) of the Electronic Communications Act (Act No. 127/2005 Coll., as amended), within which the amendment to the Directive in question, which took place as early as 2009, has not yet been taken into account. Whilst the aforementioned Article 5(3) of the Directive is currently based on the opt-in principle, the provision of Section 89(3) of the Electronic Communications Act remains structured on the opt-out principle.
In connection with the issue of the use of cookies, we would prefer, for the sake of completeness, to recall that in cases where information stored within cookies constitutes personal data, such processing will also be fully subject to GDPR regulation. Personal data means information which enables the identification of a specific natural person or relates to an already identified natural person. Although regulation in the field of personal data protection and regulation in the field of privacy of electronic communications are governed by certain common principles and their perception also often merges, and not only amongst the lay public, it is appropriate to distinguish between them. The use of cookies need not always constitute processing of personal data.
What conclusions did the court therefore reach in this case? With regard to consent for the use of cookies pursuant to Article 5(3) of the Directive on privacy and electronic communications, the court stated that such consent is not ‘validly given if the storing of information or access to already stored information in the end user’s terminal equipment via cookies is permitted by a pre-ticked box, the ticking of which the user must remove in order to refuse consent.’ This means that for these purposes, user consent to the use of cookies cannot be deemed to exist if the relevant check-box on the website is pre-ticked (user passivity is not a sufficient expression of consent). Furthermore, the court quite logically concluded that this question ‘cannot be interpreted differently depending on whether the information stored or accessed in the website user’s terminal equipment constitutes or does not constitute personal data.’ This means that with regard to consent to the use of cookies, it is not decisive whether personal data are stored within cookies or not. The requirements for such consent should always be identical.
The final conclusion reached by the CJEU in the judgement under discussion concerned the scope of the information obligation of the person intending to use cookies. Specifically, the court stated on this question that ’the information which the service provider must provide to the website user includes the duration of operation of the cookies and whether third parties will have access to these cookies.’
Josef Aujezdský, advokát
This text was originally prepared by the law firm Mašek, Kočí, Aujezdský in cooperation with the Association for Electronic Commerce (APEK) as legal circular No. 9/2019 intended for members of this association.
This text was translated from Czech to English using an AI translator.