[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLVNAqKUXpuBHD05RH0qkJyIHoT3oTILqeaqshEBRehI":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"2eeee616-0b62-41a0-9315-55bd3928efb7","CJEU - C-61\u002F19 - Orange Romania","cjeu-c-61-19-orange-romania-e4a889","Fixed categorisation ← Older revision Revision as of 07:42, 16 September 2026 Line 84: Line 84: [http:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=224083&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1 Link] of the Advocate General Opinion. [http:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=224083&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1 Link] of the Advocate General Opinion. [[index.php?title=Category:Featured decisions]] [[Category:Featured decisions]]","The Court of Justice of the European Union (CJEU) ruled that Orange Romania's method of obtaining consent for storing customer ID copies was invalid under GDPR. The court found that consent is not freely given if contracts imply refusal is difficult or requires extra steps, such as filling out a separate form, or if pre-ticked boxes are used.","CJEU rules consent invalid if contracts mislead customers on ID data storage.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-61\u002F19_-_Orange_Romania&diff=53079&oldid=52149","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-16T07:42:33+00:00","2026-09-16T08:00:14.726099+00:00",7,[17,20],{"name":18,"type":19},"Orange Romania","vendor",{"name":21,"type":22},"mobile telecommunications services","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":66},"cjeu-rules-orange-romanias-consent-practices-invalid-under-gdpr","CJEU Rules Orange Romania's Consent Practices Invalid Under GDPR","Orange Romania violated GDPR by using implied or coerced consent mechanisms — including pre-ticked boxes and burdensome opt-out processes — to collect and store copies of customer ID documents. The CJEU reaffirmed that valid consent must be freely given, specific, informed, and unambiguous, meaning any friction that discourages refusal automatically invalidates the consent. This ruling matters because organizations cannot treat consent as a checkbox formality; it must reflect a genuine, affirmative choice by the data subject. Businesses that embed consent into standard contract flows without a clear, equal opt-out risk significant regulatory exposure and reputational damage.",[56,57,58,59,60,61,62,63,64,65],"GDPR Article 4(11) — Definition of Consent","GDPR Article 7 — Conditions for Consent","GDPR Article 13 — Information to be Provided at Collection","GDPR Recital 32 — Unambiguous Consent","GDPR Recital 42 — Burden of Proof for Consent","NIST Privacy Framework PR.PO-P1 — Policies and Procedures for Data Processing","NIST SP 800-53 IP-1 — Consent","CIS Control 3 — Data Protection","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Compliance Management",{}]