Recently, two separate rulings have clarified the scope of an individual’s right to access under article 15 of the GDPR and the requirement to obtain “cookie consent” under the e-Privacy Directive.
1. Clarification of the GDPR’s right to access
The Swedish Administrative Court of Appeal has clarified that an individual’s right to access his/her personal data from a data controller entitles the individual only to receive a copy of the personal data and not a copy of the entire documentation containing the personal data.
In the case, a municipal committee had declined an individual’s request to receive a copy of his personal data. However, the court perceived that both the individual and the committee had wrongly interpreted the relevant provision of the GDPR to be targeting specific documents. The court pointed out that the GDPR does not grant a right for data subjects to access certain documents, but only to obtain a transcript of information containing a compilation of the processed data in intelligible form.
2. Clarification of the requirement to obtain cookie consent
In the second case, the Court of Justice of the European Union clarified that a provider of a website must have the internet users’ active consent for storing cookies on their terminals.
The court stated that the purpose of the mandatory “cookie consent” is to protect the user from interference with his or her private sphere and that the directive should be read together with the provisions on consent to data processing in the GDPR. Hence, consent to cookies must be active and consent by way of a pre-ticked box does not meet the requirements. The court stated that this applies irrespective of whether personal data is processed. Furthermore, the court clarified that consent needs to be specific and that information on the duration of the operation of the cookies and whether third parties may have access to the cookies must be provided.
The judgment of the Court of Justice of the European Union (which you can read more about here) provides legal certainty until the long-awaited e-Privacy Regulation comes into effect.
Time Advokatbyrå continuously provides advice within the field of data protection. If you would like to know more or need assistance with data protection legislation, please reach out to Alexander Berger, head of Data Privacy.