On March 4, 2020, Advocate General Szpunar (“AG”) delivered his opinion in the case C-61/19 Orange România SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).  The AG concluded that a printed telecommunication contract stating that customers consent to the processing of a copy of their identification card does not meet the strict requirements for consent of the GDPR, even if the customers are orally informed that they can refuse their consent by writing this by hand on the contract. According to the AG, this consent is neither “freely given” nor “specific and informed”.

The AG states, in particular, that the consent is not “freely given” because, first, customers did not indicate their consent through an affirmative action on their part and, second, because requiring customers to refuse their consent through a handwritten form “cannot be reasonably expected”.  Furthermore, the AG states that the consent was not informed because customers were not made clearly aware that consenting to the processing of the copy of their ID card was not required to enter the contract (i.e., customers that refused could still enter into the contract). In this regard, the opinion highlights the importance of informing data subjects of the consequences of refusing consent as a requisite for a valid GDPR consent, and the need for the consent to take an affirmative form.