Cookies are continuing to be thrust into the legal spotlight following 26th May 2012. This is the date from which the Information Commissioner will supposedly start clamping down on cookie law breaches. This comes after previously giving websites a year to comply with the new Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011.
Some background
In order for cookies to be placed on a user’s machine, “informed consent” must be obtained.
However, there are exceptions to this requirement, including for cookies that are “strictly necessary”. But what does “strictly necessary” actually mean? The ICO’s own guidance define such cookies as having to be “…essential, rather than reasonably necessary…” and that cookies deemed “important” would need to have informed consent obtained.
A bit of clarity
Enter the Article 29 Working Party, “an independent European advisory body on data protection and privacy”. The Working Party have provided a 12 page “opinion” (being guidance rather than law) on what is meant by “strictly necessary”. So what does it say? For a cookie to be strictly necessary, it should:
An Article 29 Party. How it might have looked?
The Working Party also discusses the distinction between “first party” cookies (those set up by the operator of a website) and “third party” cookies (set up by those not operating the website). Since third party cookies are usually related to a service not explicitly requested by the user, first party cookies are deemed more likely to be exempted from consent.
Still not clear? The Working Party anticipated this and provided some examples on the type of cookies that may benefit from the exemption…
The Examples
“User Input” cookies – those that keep track of a user’s input (such as filling in forms over a number of pages or a shopping cart).
“Authentication” cookies” – identify a user once logged into a website. The opinion emphasises that the “…act of authentication shouldn’t be taken as an opportunity to use the cookie for secondary purposes, such as behavioural monitoring…without consent”.
“User centric security” cookies – those set up for increasing security (detecting repeated failed log in attempts).
“Multimedia player” cookies – those used to store technical data for video or audio playback, such as image quality and network speeds.
“Load balancing” cookies – cookies used to manage the distribution of web requests from users to servers.
“UI customisation” cookies – those that remember a user’s preferences on a web page not linked to a user’s username. However, there is some confusion here, since the opinion indicates such cookies are only set is explicitly requested (such as clicking a button or ticking a box), which seems to be contrary to cookies being strictly necessary and not needing consent.
“Social plug in content sharing” cookies – cookies used by social media plug in modules (which, for example, allow users of social networks to share content) permitting social networks to identify their members when interacting with the plug-ins.
Although following the guidance will not guarantee avoiding the ICO’s attention, it’s hoped the information will at least assist website operators in trying to comply with the regulations. If you need any more information on cookies, get in touch with one of our data protection lawyers. If you want to send us actual cookies, our address is below.
Data breaches: Is personal data held in your systems secure?
European Commission launches process on personal data flows to UK
In these working from home days, where weekdays seem to blend into weekends which melt into weekdays again, most of us don’t have the luxury of offices at home. Space is at a premium. Desks or dining room tables are shared. Papers are strewn across the floor. We…
The Court of Appeal has held that an individual can claim for compensation under section 13 of the Data Protection Act 1998 where a breach of the DPA results in a “loss or diminution of a right to control” their personal data. A claim of compensation would not require the…