Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

1.

The present request for a preliminary ruling from the Curtea de Apel Bucureşti (Court of Appeal, Bucharest, Romania) primarily revolves around the question as to what extent and under which conditions communications such as an email newsletter are allowed by Article 13(2) of Directive 2002/58/EC ( 2 ) and whether the provisions of Regulation (EU) 2016/679 ( 3 ) are applicable.

2.

I shall argue in the present case that the marketing practices employed by the economic operator in question do not conflict with the European Union’s data protection regime. Indeed, as shall be seen, it is in the very nature of marketing practices to involve interaction with personal data and it is not unusual for a data subject to exchange data for a corresponding advantage.

3.

Article 95 of the GDPR, headed ‘Relationship with Directive 2002/58/EC’, is worded as follows:

‘This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC.’

4.

Article 13 of Directive 2002/58, headed ‘Unsolicited communications’, reads as follows:

‘1.   The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent.

2.   Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC [ ( 4 )], the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use.

…’

5.

The provisions of Romanian law relied on by the referring court are Article 1(2) and Articles 12 and 13 of Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicaților electronice (Law No 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector) and Article 1(8) of Legea nr. 365/2002 privind comerțul electronic (Law No 365/2002 on electronic commerce). That latter provision defines the concept of ‘commercial communication’ as ‘any form of communication designed to promote, directly or indirectly, the goods, services, image … of a seller or a member of a regulated profession …’.

6.

Inteligo Media SA is the publisher of the online news publication avocatnet.ro, which informs the general public about the legislative changes occurring each day in Romania.

7.

Users of the online publication can view, free of charge and without further action, a (maximum) limited number of articles set by the publication (six articles at the material time).

8.

On 27 July 2018, Inteligo Media introduced a paid subscription system called ‘Serviciu Premium’ (‘the Premium Service’) for users who, upon reaching the six-article viewing limit, wished to access additional articles from the online publication.

9.

The Premium Service subscription required the user to create a free user account on the platform. The creation of an account required the provision of the user’s email address and the user’s acceptance of the contractual terms and conditions for the provision of the Premium Service by Inteligo Media.

10.

By subscribing to the Premium Service, the user obtained the right to access two additional articles per month and to receive a daily newsletter, via email, called ‘Personal Update’ (unless the user had opted not to benefit from that service), and, for a fee and as an option, access to all of the publication’s articles and, via email, a series of more detailed daily newsletters called ‘Sinteze Informative’ (‘Informative Summaries’).

11.

The Personal Update contained, in essence, details of the legislative news from the previous day, with a hyperlink to the relevant articles that appeared in the publication.

12.

In order to allow users, when their email address is obtained, to opt out of receiving the Personal Update, the words ‘Nu vreau să primesc Personal Update, informarea transmisă zilnic gratuit pe e-mail de avocatnet.ro’ (‘I do not want to receive Personal Update, the free daily email newsletter from avocatnet.ro’) appeared next to a tickbox in the account creation form which needed to be ticked by the user. Similarly, when receiving any newsletter by email, users who no longer wished to receive the Personal Update could select the ‘Dezabonare’ (‘Unsubscribe’) option.

13.

For users who created their account on the platform for a purpose other than subscribing to the free Premium Service and accessing additional content, the field relating to the Personal Update was programmed not to appear and the Personal Update was not sent to those categories of user.

14.

On 26 September 2019, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (National Supervisory Authority for the Processing of Personal Data, Romania) (‘the ANSPDCP’) drew up a report on its findings and on the administrative penalty by which it imposed on Inteligo Media an administrative fine of 42714 Romanian lei (RON) (the equivalent of EUR 9000). In that report, it was found that, from July 2018, Inteligo Media had processed the personal data (email addresses, passwords, usernames) of 4357 users (natural persons) on the grounds of a legal basis which was not appropriate for the purpose of the processing in question, namely the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users concerned to the processing of their personal data for that purpose. The ANSPDCP concluded that Inteligo Media had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 of the GDPR.

15.

Inteligo Media lodged a complaint with the Tribunalul București – Secția a II-a de Contencios Administrativ și Fiscal (Regional Court, Bucharest – Second Division for Administrative and Tax Matters, Romania) requesting, principally, the annulment of the ANSPDCP report and its exemption from liability for the administrative offence.

16.

The judgment delivered on 5 June 2020 by that court, which dismissed the appellant’s complaint, was overturned on appeal by the Curtea de Apel București (Court of Appeal, Bucharest, Romania) and the case was referred back for a new judgment.

17.

After re-examining the case, the Tribunalul București – Secția a II-a de Contencios Administrativ și Fiscal (Regional Court, Bucharest – Second Division for Administrative and Tax Matters), by civil judgment of 15 December 2021, partially upheld the complaint and reduced the fine imposed; however, it upheld the finding of an offence for the infringement of the requirement to obtain express consent in relation to the processing of data through the Personal Update, in accordance with the GDPR.

18.

Both the appellant and the respondent have appealed against that civil judgment. Those appeals are pending before the referring court, the Curtea de Apel București (Court of Appeal, Bucharest).

19.

The referring court considers that the outcome of the dispute in the main proceedings depends on the identification of the appropriate legal basis for the processing of personal data at issue in the main proceedings and the conditions which must be satisfied in order for that processing to be lawful in accordance with Directive 2002/58 and the GDPR.

20.

According to that court, it is necessary to clarify, first, the conditions under which a user’s email address may be regarded as having been obtained ‘in the context of the sale of a product or a service’ within the meaning of Article 13(2) of Directive 2002/58, second, the scope of the concept of ‘direct marketing’ in Article 13 of that directive, and, third, whether that concept is equivalent to that of ‘commercial communication’, used by the national legislature when transposing Article 13 thereof.

21.

Next, if, in the present case, users’ email addresses were not obtained ‘in the context of the sale of a product or a service’ within the meaning of Article 13(2) of Directive 2002/58, it would be necessary to determine whether the transmission by email of the Personal Update triggers the application of Article 13(1) of that directive, relating to obtaining the prior consent of users, and to confirm which provisions provide a penalty for possible infringement of that provision.

22.

Lastly, the referring court considers it necessary to clarify the obligations incumbent on the ANSPDCP when it applies Article 83(2) of the GDPR, in so far as those obligations are not clear from the wording of that article.

23.

In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

24.

Written observations were submitted by the parties to the main proceedings, Romania and the European Commission. Inteligo Media and the Commission attended the hearing held on 27 November 2024.

25.

By its first question and the first part of its fourth question, which I shall examine together, the referring court seeks to ascertain, in essence, whether it can be considered that a user’s email address obtained when he or she creates an online account entitling him or her (i) to free access to a number of articles from the publication concerned, (ii) to receive, by email, a daily newsletter containing a summary of new legislation covered in articles of the publication as well as hyperlinks to those articles and (iii) to access, for a fee, additional and/or more detailed articles and analyses of the publication, is obtained ‘in connection with the sale of a product or a service’ and whether the transmission of the daily newsletter described in (ii) constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of Article 13(2) of Directive 2002/58.

26.

Article 13 of that directive governs the lawfulness of unsolicited communications.

27.

In that connection, Article 13(1) of Directive 2002/58 authorises the use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for purposes of direct marketing provided that the communications are transmitted to users who have given their prior consent, that is to say, those who have ‘opted in’.

28.

Article 13(2) of Directive 2002/58, on the other hand, creates an exception under which electronic contact information obtained from users in accordance with the GDPR and in the context of the sale of a product or a service may be used for direct marketing of similar products or services without prior consent, so long as users are given the opportunity to ‘opt out’ of receiving such communications upon collection of their contact information. Should the user not opt out at this time, a further opportunity to do so is to be provided upon receipt of each direct marketing communication.

29.

Together, these provisions govern the conditions under which direct marketing communications are permissible. If the Court were to find that a communication such as that at issue in the main proceedings does not constitute direct marketing, it would not fall within the scope of either provision, and the Court’s analysis would be restricted to the scope of the GDPR. Therefore, it is necessary, in the first place, to determine whether a communication such as the Personal Update constitutes direct marketing.

30.

The Court has held that in order to determine whether a communication has the purpose of direct marketing, it is necessary to ascertain, first, whether that communication pursues a commercial purpose and, second, whether it is addressed directly and individually to a consumer. ( 6 )

31.

A communication which pursues a commercial purpose constitutes or is related to ‘buying and selling … to generate revenue or profit’. ( 7 ) Whether the Personal Update serves such a purpose is disputed by the parties. As argued by the ANSPDCP and the Romanian Government, the contents of that newsletter were purely editorial ( 8 ) and therefore precluded from being classified as direct marketing. Inteligo Media and the Commission, on the other hand, argue that the newsletter has a commercial purpose in so far as it promotes articles available on the publisher’s platform.

32.

I am more persuaded by the latter argument. It is clear that the intent of these emails is not to provide, free of charge, an account of legislative changes in Romania that the user can read in full from the comfort of their own inbox. Rather, by providing hyperlinks to articles on the publication’s webpage, the Personal Update provides users with a ‘teaser’ of articles with the intent of enticing them to consume more quickly the eight articles they may read for free each month.

33.

Here, it is useful to distinguish between ‘hard’ and ‘metered’ paywalls used by online press publications. Under a hard paywall, a user must pay a subscription before accessing any content whatsoever. While this ensures that publishers directly profit whenever a user accesses any article, from the perspective of the publishers it poses the risk of deterring potential customers. A ‘metered’ paywall, on the other hand, is a strategy used by publishers to entice users eventually to purchase a full subscription by allowing them to access, free of charge, a limited number of articles before requiring payment. ( 9 )

34.

The commercial purpose of Inteligo Media’s metered paywall is apparent when the intended audience of the Personal Update is considered. Presumably, any user who provides their electronic contact information to avocatnet.ro for the purposes of viewing more than six free articles per month and receiving an email newsletter has, at the very least, a basic interest in staying up to date on legislative changes in Romania. The Personal Update ensures that every day, such users will be directly presented with multiple hyperlinks to articles on a subject of interest to them. It is likely that these users will open eight of the articles within days or weeks, leaving them with no choice but to pay a full subscription should they wish to read any additional articles during the remainder of the month.

35.

Therefore, by enticing users to purchase a full subscription, the Personal Update pursues the commercial purpose of generating revenue under the metered paywall model.

36.

To constitute direct marketing, the Personal Update must also be addressed directly and individually to a consumer. ( 10 ) The Court has held that this condition is satisfied when the communication is directly displayed in the inbox of the private email service of the user concerned. According to the order for reference, that is precisely how the Personal Update was displayed for users who provided their electronic contact information to Inteligo Media.

37.

Therefore, in accordance with the case-law of the Court, a communication such as that at issue in the main proceedings constitutes direct marketing.

38.

Next, we need to examine whether the email addresses in question are obtained ‘in the context of the sale of a product or a service’ within the meaning of Article 13(2) of Directive 2002/58. If that were the case, then prior consent would not be necessary.

39.

Directive 2002/58 itself does not provide much guidance as to the precise meaning of this phrase. Such a term, which makes no express reference to the law of the Member States for the purpose of determining its meaning and scope, must normally be given an autonomous and uniform interpretation throughout the European Union. ( 11 )

40.

According to a commonly accepted definition, a ‘sale’ is an agreement which necessarily entails a payment in exchange for a good or a service. ( 12 )

41.

Given that we are dealing with a service, guidance can, moreover, be sought in the Court’s case-law on Directive 2000/31 and on the relevant Treaty provisions.

42.

In the context of Directive 2000/31, the Court has held that remuneration for a service is not necessarily paid for by those for whom it is performed. ( 13 ) The Court specified that this is the case where the performance of a service free of charge is provided by a service provider for the purposes of advertising, since the cost of that activity is incorporated into the price of the goods or services advertised. ( 14 )

43.

This is precisely the scenario at issue in the main proceedings. As outlined above, the service provided ‘free of charge’ by Inteligo Media (provision of the Personal Update and access to additional articles) was intended to promote the purchase of the full subscription plan, thereby pursuing an advertising purpose. As in the judgment in McFadden, the cost of providing such a service is incorporated into the price of the main service, which is, in the present case, the full subscription. This indirect form of remuneration satisfies the requirement of payment under the Court’s definition of a ‘sale’.

44.

Moreover, also in the context of the freedom to provide services under Articles 56 and 57 TFEU, it is immaterial who it is that pays the provider for the service. ( 15 ) It follows from settled case-law that Article 57 TFEU does not require that the service provided be paid for by those who benefit from it. ( 16 )

45.

In addition to this, it should not be forgotten that in the modern digital age, data themselves are treated as a commodity. ( 17 ) Thus, it could be envisaged that for data to have been collected ‘in the context of a sale’, it is sufficient that, in lieu of financial consideration, a user furnishes their personal data in exchange for a good or service of value to them.

46.

In conclusion, I propose to reply to the first question and the first part of the fourth question that Article 13(2) of Directive 2002/58 must be interpreted as meaning that a user’s email address obtained when he or she creates an online account entitling him or her (i) to free access to a number of articles from the publication concerned, (ii) to receive, by email, a daily newsletter containing a summary of new legislation covered in articles of the publication as well as hyperlinks to those articles and (iii) to access, for a fee, additional and/or more detailed articles and analyses of the publication, is obtained ‘in connection with the sale of a product or a service’. The transmission of the daily newsletter described in (ii) constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of that provision.

47.

Given the proposed reply to the first question and the first part of the fourth question, there is no need to reply to the second part of the fourth question.

48.

By its second question, the referring court seeks, in essence, to ascertain which of the conditions set out in Article 6(1)(a) to (f) of the GDPR is applicable when the data controller uses a user’s email address to send a daily newsletter such as the Personal Update in accordance with Article 13(2) of Directive 2002/58.

49.

Article 95 of the GDPR specifies that that regulation is not to impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the European Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58. The relationship between that directive and the GDPR is therefore governed by the principle lex specialis derogat legi generali: whenever there is a specific provision in Directive 2002/58 entailing obligations with the same objective as corresponding provisions in the GDPR, it is the provision of Directive 2002/58 which must be applied.

50.

I take the view that, with respect to automated and direct marketing in the context of the sale of a product or a service, Article 13(2) of Directive 2002/58 governs comprehensively the conditions and purposes of the processing as well as the rights of the data subject and imposes ‘specific obligations’ on the controller, within the meaning of Article 95 of the GDPR. In particular, I consider that Article 13(2) of Directive 2002/58 deals comprehensively with the question of consent. This can, in particular, be inferred from the fact that that provision constitutes an exception to Article 13(1) of that directive, which requires prior consent.

51.

As a consequence, the lawfulness of the processing can be established on the basis of Article 13(2) of Directive 2002/58. Recourse to the GDPR, in particular Article 6(1)(a) to (f) thereof, is neither possible nor necessary.

52.

Accordingly, my proposed reply to the second question is that Article 13(2) of Directive 2002/58, read in conjunction with Article 95 of the GDPR, must be interpreted as meaning that, where the controller uses a user’s email address in order to send a daily newsletter, in accordance with Article 13(2) of Directive 2002/58, and the processing of personal data has been found lawful on the basis of that provision, Article 6 of the GDPR is not applicable.

53.

By its third question, the referring court asks whether Article 13(1) and (2) of Directive 2002/58 must be interpreted as precluding national legislation which, in transposing that directive, replaces the term ‘direct marketing’ with the term ‘commercial communication’, as defined in Article (2)(f) of Directive 2000/31.

54.

Article 2(f) of Directive 2000/31 defines the concept of ‘commercial communication’ as any form of communication designed to promote, directly or indirectly, the goods, services or image of a company, organisation or person pursuing a commercial, industrial or craft activity or exercising a regulated profession.

55.

Under that provision, information enabling direct access to the activity of the company, organisation or person, in particular a domain name or an email address, is not, in itself, a commercial communication, nor are communications relating to the goods, services or image of the company, organisation or person compiled in an independent manner, particularly when they are provided for no financial consideration.

56.

Yet, as explained above, a communication constituting ‘direct marketing’ within the meaning of Directive 2002/58 must have a commercial purpose and be addressed directly and individually to a consumer. Under this framework, commercial communication has a wider scope that encompasses the concept of direct marketing; thus all direct marketing constitutes commercial communication, but not all commercial communication constitutes direct marketing.

57.

As a consequence, I consider the third question to be hypothetical with respect to the case at issue in the main proceedings and, therefore, in the context of the present request for a preliminary ruling, inadmissible. It is not necessary in order to resolve the dispute at issue in the main proceedings. The referring court can resolve the case before it without it being necessary to reply to the third question. Indeed, in the context of the present request for a preliminary ruling it is not for a national court to seek to ascertain, in abstracto, whether a Member State has correctly transposed secondary law. This is better left to infringement proceedings.

58.

By its fifth question, the referring court wishes to know, in essence, whether, when a supervisory authority imposes an administrative fine, it is required to analyse and explain in the administrative act concerned the impact of each of the criteria provided for in Article 83(2)(a) to (k) of the GDPR.

59.

Since that question refers to the eventuality that the GDPR is applicable to the present case, and given that my analysis leads me to the conclusion that the present case falls under Article 13(2) of Directive 2002/58 only, there is no need to reply to the question.

60.

The following observations are therefore made only on the basis that the Court should find that the GDPR is applicable.

61.

Under the terms of Article 83(2) of the GDPR, when deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard must be given to the list which follows in that provision. ( 18 )

62.

While Article 83(2) of the GDPR in the first place outlines the obligations of the competent authorities (and not the rights of the data subjects), Article 83(8) of the GDPR specifies that the exercise by the supervisory authority of its powers under that article is to be subject to appropriate procedural safeguards in accordance with EU and Member State law, including effective judicial remedy and due process. ( 19 )

63.

Moreover, Article 83(2) of the GDPR must be interpreted in the light of the general principle of EU law according to which the right to good administration entails the obligation for the administration to justify its decisions. This obligation of the administration to state reasons for a decision which are sufficiently specific and concrete to allow the person concerned to understand the grounds of the individual measure adversely affecting him or her is a corollary of the principle of respect for the rights of the defence, which is a general principle of EU law. ( 20 )

64.

In conclusion, as long as an individual is in a position to understand the grounds of the individual measure adversely affecting him or her, that principle is complied with, without it being necessary to go into detail regarding each of the criteria listed in Article 83(2) of the GDPR.

65.

In the light of the foregoing considerations, I propose that the Court answer the questions referred by the Curtea de Apel Bucureşti (Court of Appeal, Bucharest, Romania) as follows: