[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8D_oqsu--erQOZVnhnCBJWYjFYBtmOO9VKz6dZCc3lI":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"d5b0b54c-113a-459f-af64-d9cec0de03c6","CJEU - C-317\u002F25","cjeu-c-317-25-a2678b","Fixed link ← Older revision Revision as of 08:06, 8 October 2026 Line 91: Line 91: |Reference_Body=Conseil d’État |Reference_Body=CE (France) |Reference_Case_Number_Name=SAN-2023-015 |Reference_Case_Number_Name=SAN-2023-015","The Advocate General of the Court of Justice of the European Union (CJEU) opined that consent for direct marketing purposes given to an undertaking for its unidentified \"partners\" is not sufficiently informed under GDPR. The case involves Groupe Canal+ which used personal data collected by ISPs, where subscribers ticked a box consenting to marketing by the ISP's \"partners\" without these partners being identified. The AG stated that such a partner must obtain new consent before performing direct marketing.","CJEU AG: Consent for unidentified \"partners\" in direct marketing is not sufficiently informed.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-317\u002F25&diff=53337&oldid=53179","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-10-08T08:06:18+00:00","2026-10-08T10:00:15.999949+00:00",7,[17,20,23],{"name":18,"type":19},"Groupe Canal+","product",{"name":21,"type":22},"CNIL","vendor",{"name":24,"type":25},"internet service providers","technology","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":26,"icon":28,"name":29,"slug":30},null,"GDPR","gdpr",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,18],{"controls":52,"vendors":53},[],[],{"slug":55,"title":56,"body":57,"framework_refs":58,"framework_notes":69},"cjeu-rules-vague-partners-consent-invalid-under-gdpr","CJEU Rules Vague 'Partners' Consent Invalid Under GDPR","The CJEU Advocate General found that consent granted to unnamed 'partners' for direct marketing fails GDPR's requirement for informed, specific consent. Groupe Canal+ relied on data collected by ISPs where subscribers consented to marketing by unidentified third parties — a practice the AG ruled insufficient. This matters because organisations cannot launder consent through vague, catch-all language to share personal data with undisclosed recipients. Any partner wishing to use such data for direct marketing must independently obtain fresh, valid consent from each data subject.",[59,60,61,62,63,64,65,66,67,68],"GDPR Article 4(11) — Definition of Consent","GDPR Article 5(1)(a) — Lawfulness, Fairness and Transparency","GDPR Article 6(1)(a) — Lawful Basis: Consent","GDPR Article 7 — Conditions for Consent","GDPR Article 13 & 14 — Transparency and Information Obligations","GDPR Article 30 — Records of Processing Activities","EDPB Guidelines 05\u002F2020 on Consent","NIST Privacy Framework PR.CP-1 — Consent Management","CIS Control 3 — Data Protection (Data Classification and Handling)","ISO\u002FIEC 27701 — Privacy Information Management (PIMS)",{}]