New rules about the EU Cookie Directive and use of cookies came into effect in the UK on 26 May 2011. Many people have asked what impact the new rules will have on Users of their websites and what they need to do to ensure compliance with the new law.
- Download our FREE whitepaper now to read about our recommended approach to EU Cookie legislation compliance for law firms.
EU Cookie Directive - The Legal Landscape.
Personal Details
For years there has been legitimate concern over the use and exchange of personal information (e.g. name, address, age) – this was addressed in the Data Protection Act (DPA) of 1998. Most people have heard about the Act and appreciate the need for it.
The Act deals with a wide range of issues to do with the collection, storage and exchange of "personal data" and applies regardless of how the information is obtained (i.e. The Act certainly covers data gathered via the Internet but is not restricted to it).
Behavioural Data
More recently, concern has grown over a rather different form of personal information that can best be described as "behavioural data". This is information that can be derived about you without necessarily knowing exactly who you are. If you visit three different websites that all happen to carry advertising delivered by the same advertising network then it is possible for that network to track the fact that you have used all three sites and derive some knowledge from that which could be commercially valuable.
For example, the advertising network might use the information to determine what advertisements to display to you. In most cases, the companies that collect behavioural data about your Internet usage will not know exactly who you are, but they will know that you are the same person who used website-A last Monday and website-B last Wednesday. Advertising networks do this by assigning you a unique ID that is stored in a cookie by your web browser.
It is this form of use/abuse of personal information that was supposed to be the primary motivation behind the EU Privacy Directive published in 2002 and updated in 2009.
What's the Problem with the EU Cookie Directive?
The EU Cookie Directive ended up being written quite broadly - it is not limited to the use of cookies by advertising networks (so called "third party cookies") it applies equally to all cookies and even to other non-cookie-based technologies that might be used to identify a User.
What Are Other Firms Doing Regarding Compliance?
A lot of firms wont be making any changes live until after May 26th but here are some examples of firms that have released solutions already:
- BBC - Header options
- Nationwide - Drop down from top of page (only happens the first time you visit the site) plus a permanent link in the footer. No opt-out option so not really "compliant".
- BT Products - modest yet comprehensive (information in footer)
- BT - the same solution is now on their main website
- Information Commissioners Office - intrusive and ugly (not recommended)
- McClurne Naismith - rather clunky and intrusive
- Gloucestershire County Council - functional....but too intrusive
