ZGODA NA PRZETWARZANIE DANYCH OSOBOWYCH I PROFILOWANIE UWAGI NA TLE WYROKU TRYBUNAŁU SPRAWIEDLIWOŚCI UE Z DNIA 1 PAŹDZIERNIKA 2019 R. W SPRAWIE C-673/17
CONSENT TO THE PROCESSING OF PERSONAL DATA AND PROFILING. OBSERVATIONS ON THE JUDGMENT OF THE EU COURT OF JUSTICE OF 1 OCTOBER 2019 IN CASE C-673/17

Summary/Abstract: Background: The subject matter of this research is the CJEU judgment on 1 October 2019 in case C-673/17 (Planet 49). The article analyses the issue of personal data protection in respect to information obligations and conditions of consent. These are required under the GDPR in cases where personal data are processed by computerised data collection tools that affect electronic communications networks’ users’ private of information including personal data stored on end devices used for remote identification and tracking of end users. Research purpose: The purpose of research in the article is to assess legal solutions relating to the obligation to use cookies as one of the technologies that store or access information on the devices of end users. In the current legal environment, there is no legal definition of cookies, not only because it is not the only technology allowing for collecting information from end devices but also due to various sources of origin as well as various functions of cookies (e.g. analytical, marketing, safety cookies). Cookies that may be installed on the end user’s device may contain a number assigned to the user’s registration data, which means that if such number is matched to the user’s personal data, data stored by cookies are personalised and, therefore, collection of data with the use of cookies may constitute processing of personal data. One of the forms of automated personal data processing is profiling, which consists in the use of personal data for assessment of certain personal features of a natural person. Processing of personal data is conditional upon the existence of prerequisites to lawfulness of personal data processing indicated in Article 6 and Article 9 of the GDPR, which include consent of the data subject. The purpose of consent as one of independent grounds for personal data processing is to ensure that the data subject is granted information autonomy in cases where the possibility of data processing depends on his or her decision. In order for a given act or statement to qualify as consent, it is necessary that there cumulatively exist all the structural elements of consent, listed in Article 7 of the GDPR, which must be met also if statements are made online. Methods: The applicable provisions have been analysed using the legal comparative method, taking into account that in its judgment of 1 October 2019 in case C-673/17 (Planet 49) the Court in Luxembourg addressed the issue of consent to placing marketing cookies and the scope of information that must be provided when such consent is sought. Conclusions: Placement of marketing cookies requires consent, meeting conditions for obtaining consent, and applying GDPR-compliant information standards.

• Details
• Contents