DATA PROTECTION
EU Court of Justice: relationship between GDPR and ePrivacy Directive as regard to consent and right to cancellation of personal data.
The European Court of Justice issued, on 27 October 2022, the judgment of the Union in case C-129/21 Proximus NV v. Gegevensbeschermingsautoriteit.
The case: in the context of the dispute between Proximus NV, a Belgian public law company, and the Belgian Data Protection Authority, the Brussels Court of Appeal submitted to the CJEU a request for a preliminary ruling on the interpretation of article 12, paragraph 2, in conjunction with article 2, paragraph 2, letter f), directive on privacy and electronic communications (2002/58 / EC) as well as of articles 5, paragraph 2, 17, 24 and 95 of the GDPR.
The CJEU, in the relationship between the two regulations regarding consent and the right to delete data, clarified that:
(A) the consent, pursuant to Article 4 (11) of the GDPR, of a subscriber of a telephone service operator is necessary for that subscriber's personal data to be included in the available telephone directories and directory inquiry services publications from suppliers other than the operator;
(B) said consent can be given both to the operator and to one of the suppliers;
(C) Article 17 of the GDPR establishes the subscriber's request to delete their personal data from telephone directories lists of available directories and from consultation services;
(D) pursuant to Article 5, paragraph 2, and 24 of the GDPR, a national data protection authority may request a provider of publicly accessible telephone directories and telephone directory consultation services, as the owner of the directory telephone processing, to adopt adequate technical and organizational measures to inform third parties - data controllers - of the withdrawal of the subscriber's consent.
Furthermore, Article 17 (2) of the GDPR can legitimately base the order of a national data protection authority on a provider of publicly available telephone directories and telephone directory selection services, to which a subscriber of a provider have requested that data and data concerning him are no longer published, to take telephone measures in order to inform the search engine operators of the request for data.
The case: in the context of the dispute between Proximus NV, a Belgian public law company, and the Belgian Data Protection Authority, the Brussels Court of Appeal submitted to the CJEU a request for a preliminary ruling on the interpretation of article 12, paragraph 2, in conjunction with article 2, paragraph 2, letter f), directive on privacy and electronic communications (2002/58 / EC) as well as of articles 5, paragraph 2, 17, 24 and 95 of the GDPR.
The CJEU, in the relationship between the two regulations regarding consent and the right to delete data, clarified that:
(A) the consent, pursuant to Article 4 (11) of the GDPR, of a subscriber of a telephone service operator is necessary for that subscriber's personal data to be included in the available telephone directories and directory inquiry services publications from suppliers other than the operator;
(B) said consent can be given both to the operator and to one of the suppliers;
(C) Article 17 of the GDPR establishes the subscriber's request to delete their personal data from telephone directories lists of available directories and from consultation services;
(D) pursuant to Article 5, paragraph 2, and 24 of the GDPR, a national data protection authority may request a provider of publicly accessible telephone directories and telephone directory consultation services, as the owner of the directory telephone processing, to adopt adequate technical and organizational measures to inform third parties - data controllers - of the withdrawal of the subscriber's consent.
Furthermore, Article 17 (2) of the GDPR can legitimately base the order of a national data protection authority on a provider of publicly available telephone directories and telephone directory selection services, to which a subscriber of a provider have requested that data and data concerning him are no longer published, to take telephone measures in order to inform the search engine operators of the request for data.
