Unfair practices of requiring consent when using cookies - cookie wall and scrolling. GDPR
Cookies and other elements monitoring the activity of website users are understood as personal data, as it is possible to identify a natural person (data subject) on the basis of them, and can therefore only be used with the expressed consent of the data subjects. Such consent must be in accordance with Article 4, paragraph 11 of the GDPR, ie. it must befreely given, specific, informed and unambiguous. Cookies are also regulated in parallel by Directive 2002/58 / EC of the European Parliament and of the Council, Directive on privacy and electronic communications. In its Article 5 (3) are regulated cookies for technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. Consent to use is not required for such cookies.
For other cookies, the conditions for obtaining consent to use are the same as in the regime of the GDPR (paragraph 7 of the Guidelines). Like the EDPB, the Office for Personal Data Protection has previously stated its similar opinion in its recommendation on the processing of cookies and similar means of monitoring since 25 May 2018 (hereinafter referred to as the “Recommendation”).
In connection with the expression of consent by simply scrolling the displayed website (so-called scrolling), the EDPB states that such action does not meet the condition of unambiguous expression of will. Moving the cursor around the screen or moving it does not constitute unambiguous consent. The main argument against scrolling is the fact that it cannot be revoked in the same way. Withdrawal of consent must be as easy as giving it (Article 7 of the GDPR).
Similarly, the EDPB noted that pre-filled "opt-out" windows also do not constitute consent (paragraphs 79-80 of the Guidelines). This case has already been resolved by the case law of the Court of Justice of the European Union (C-673/17):
“…It follows that the consent referred to in Article 2(f) and in Article 5(3) of Directive 2002/58, read in conjunction with Article 4(11) and Article 6(1)(a) of Regulation 2016/679, is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his or her consent.“
The EDPB also considered the possibility of giving consent through web browser settings (paragraph 89 of the Guidelines). According to the EDPB, such consent is valid if it meets the conditions of the GDPR. The Office for Personal Data Protection similarly stated this in its Recommendation.
In any event, consent must always be obtained before the controller starts processing personal data for which consent is required (so-called opt-in). Although the GDPR in Article 4 (11) does not explicitly state that consent must be given before processing, this is clearly indicated. WP29 (Working Group 29, paragraph 90 of the Guidelines) also stated this clearly and consistently in its expert opinions.
For more information, contact us at:
JUDr. Mojmír Ježek, Ph.D.
ECOVIS ježek, advokátní kancelář s.r.o.
Betlémské nám. 6
110 00 Praha 1
AboutECOVIS ježek advokátní kancelář s.r.o.
The Czech law office in Prague ECOVIS ježek practices mainly in the area ofCzech commercial law,Czech real estate law,representation at Czech courts, administrative bodies and arbitration courts, as well asCzech finance and banking law, and provides full-fledged advice in all areas, making it a suitable alternative for clients of international law offices. The international dimension of the Czech legal services provided is ensured through past experience and through co-operation with leading legal offices in most European countries, the US, and other jurisdictions. TheCzech lawyers of the ECOVIS ježek teamhave many years of experience from leading international law offices and tax companies, in providing legal advice to multinational corporations, large Czech companies, but also to medium-sized companies and individual clients. For more information, go towww.ecovislegal.cz/en.