An amendment to the Privacy and Electronic Communications Act is a change to legislation that comes into force in the UK on the 26th May 2011. The adapted section is commonly called “The Cookie Law” as it affects how your online business, and the businesses that you work with, use cookies and other “cookie like” data stores of information such as Adobe Flash’s Local Shared Objects as well as browser web storage.
The legislation dates back to 2003 but was revised with changes to cookie like data,
Previous PECR Section 6
6. (1) Subject to paragraph (4), a person shall not use an electronic communications network to store information, or to gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met. (2) The requirements are that the subscriber or user of that terminal equipment -
- (a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
- (b) is given the opportunity to refuse the storage of or access to that information
Is being changed to now read.
6 (1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met. (2)The requirements are that the subscriber or user of that terminal equipment–
- (a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
- (b) has given his or her consent.
(3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient for 2the purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use. (3A) For the purposes of paragraph (2), consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent. (4) Paragraph (1) shall not apply to the technical storage of, or access to, information–
- (a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or
- (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.
This change means that consent to information must be given by a website visitor. The ICO has released a guidance notes and advice on the implementation of this change. What is not clear however is what consent means and how to gain it in a manner that is both compliant and allows a business to function effectively.
Despite the departments name, it seems that the Information Commissioner’s Office has not delivered meaningful and detailed information. Despite this there are many actionable points that have been shown and multiple “clues” as to how the act will be enforced going forward.
Please notice that I said enforcement above, as it is always the interpretation of the law and how it will be enforced as the defining factor as to whether something is legitimate or not. The Information Commissioner has made it clear that enforcement action will NOT be taking place from the 26th May date when the legislation passes into effect but will expect businesses to have firm and sound plans in place to comply.
But what does it mean to “comply with the act” and how will that affect your business?
If you were to undertake perfection in your data compliance exercise then your site would end up looking like David Naylor’s excellent example that he gives on his blog. I do not believe that this is how the UK Government intends web businesses to operate and neither do I believe it will be how businesses will enact the legislative change.
Ed Vaizey is the Minister for Culture, Communications and Creative Industries, a Parliamentary Under-Secretary of State post with responsibilities in both the Department for Culture, Media and Sport (DCMS) and the Department for Business, Innovation and Skills (BIS). In a speech to the Confederation of British Industry (The CBI) he said:
It seems to me that consumers have two key concerns around privacy. The first is about what happens to the data that we upload: the bank details we submit when we buy our groceries online; the family video on myspace; the photo on Facebook. The second concern is more complicated and relates to what others know about us and where we have been, to the fear of the online big-brother; a debate which in the US has come to be known as “do not track”.
Let’s be clear about where we are today. Many people voluntarily give up their privacy when they go online. But they still want a number of rules to apply.
They want the sites they use to be secure; they want to be sure that their data is kept securely; and they want internet companies to be transparent in how their data is used in terms of tracking their activity on the web.
There are many benefits to internet sites knowing who you are, or indeed where you are, in terms of providing tailored information. People just want to have the option to say ‘yes’ or ‘no’ before allowing it to happen.
Now let me be clear. When it comes to addressing these concerns, I am not a big fan of regulation.
When Government steps into the fast moving world of technology we risk creating more problems than we can solve. If industry can bring in its own measures to reassure customers – such as clear guidelines in plain English and greater transparency – not only will they win customers, they will avoid regulation.
The red emphasis above (and below) is mine as I feel this are important areas to focus on.
Ed Vaizey went on to say:
Of these, it is the cookies provision that is the biggest change, and therefore of most concern to business. It’s a good example of a well-meaning regulation that will be very difficult to make work in practice. If we get the implementation wrong, it will seriously hamper the smooth running of the internet, and so it’s therefore a provision that should concern the consumer as well.
That’s why our approach to this very challenging provision is a sensible and pragmatic one. We have made it clear, for example, that the consent of the user is not needed where a cookie is essential for a service that has been requested by the user. The use of cookies for shopping baskets on websites, for example.
We are also supporting cross-industry work on the use of third party cookies in behavioural advertising.
and then also
We are also working with the browser manufacturers to see if browsers can be enhanced to provide relevant information about cookies, as well as easy to use settings. Because we want users to be able to make informed decisions about what they do or don’t allow on to their machines.
However, a one size fits all solution will not cover everything. There will, inevitably, be legitimate uses of cookies that fall through the cracks.
That’s why it is so important for us to adopt a flexible approach – so that new business models and innovations that no one has yet thought of are not held back.
We don’t want to be prescriptive. We want business, regulators and consumers to continue to work together to provide solutions as problems arise. And we want to see sensible solutions that balance privacy and innovation.
Ed Vaizey’s speech was very welcome and gave some very strong clues as to what is OK and what isn’t along with the problems associated with trying to taint all cookies or cookie look mechanisms with the same brush.
Some points in the speech were backed up by sections in today’s ICO advice.
I have heard that browser settings can be used to indicate consent – can I rely on that?
One of the suggestions in the new Directive is that the user’s browser settings are one possible means to get user consent. In other words, if the user visits your website, you can identify that their browser is set up to allow cookies of types A, B and C but not of type D and as a result you can be confident that in setting A, B and C you have his consent to do so. You would not set cookie D. At present, most browser settings are not sophisticated enough to allow you to assume that the user has given their consent to allow your website to set a cookie. Also, not everyone who visits your site will do so using a browser. They may, for example, have used an application on their mobile device. So, for now we are advising organisations which use cookies or other means of storing information on a user’s equipment that they have to gain consent some other way.
We also know that the UK Government has been speaking with (The Govt. use the term “working with”) browser manufacturers. Some of the new areas that have come out from these discussions, either directly or not, are features such as the Do Not Track feature in Mozilla browsers such as Firefox. Similar features are due to be enabled within Internet Explorer and Apple’s Safari. Google has so far decided not to include the feature by default within their browser but has released an extension to Chrome that delivers similar functionality.
Happening concurrently with EU and UK changes there is much discussion occurring over on the other side of the Atlantic, a lot of which is very similar to that happening within Europe. I am far from best placed to comment on US legislation and the processes that bills go through before they become law, but I do believe that much of the US changes that are likely to occur are extremely similar to those within the UK. It is this that I believe Ed Vaizey was referencing when he said:
Creating an international standard for on-line privacy will ensure businesses compete on a level playing field while web users enjoy the same protections wherever a website is based. This may seem like a lofty ambition. But I think that looking at trends in the US and intentions in Europe, it is clear that the two are not poles apart. Indeed, both the Commission and the American Administration recognise that this is a problem that needs to be addressed.
It is probably no coincidence that yesterday, the Internet Advertising Bureau, the trade body for the UK online advertising industry announced the released of Pan European guidelines on behavioural targeting & the full guidelines here
It should probably be noted that the IAB defines behavioural advertising as
Online Behavioural Advertising is the collection of online information to facilitate the delivery of display advertising based upon the potential preferences or interests of web users or to advertise a product consumers have shown an interest in previously. For example: a consumer searching online for a new car and therefore visiting vehicle websites may – in a later online session – be shown car advertisements.
In your own business it is unlikely that you classify as a business that delivers behavioural advertising. Not many of the people reading this will be Google, Yahoo or a myriad of other retargeting companies. What some of you may well do though is sell advertising to networks such as Google, Yahoo or others. It is not clear that if you sell advertising via a broker like Google , via say Adsense, whether you will need to definitively tell your visitors that you do so.
The IAB would say that, Google, or the relevant advertising brokerage that you work with, will show a symbol on your site which will link to meaningful information explaining what kind of data is gathered and how, as well as giving the visitor the ability to opt out. It is this that the advertising industry believes complies with EU (and likely US) law.
The clues in the ICO information and the CBI speech infer this would be the case – When the IAB show the i symbol in a prominent position, it could be argued by them that this is similar and arguably better than the ICOs use of the term “scrolling piece of text”!
Where we stand at the moment is an area without clear specific guidelines but many clues as to what the ICO will accept and will not accept as we go forward.
If you are a business that runs an e commerce store, and as part of the e commerce transaction need to store products that the user has put in their cart, then in my interpretation of the legislation, you will NOT require explicit pre informed consent as that is the primary focus of your business.
If though you allowed advertising from your site enabled via a third party then make sure you work with a partner that delivers the functionality that is similar to the IAB. They make clear that adverts which are shown have a link to a detailed explanation about what data is gathered and how, always delivering a link allowing people to opt out. It is NOT clear if this will be enough to placate the ICO or the US equivalent organisations but it is definitely better than not telling your visitors any thing. If you are unsure then you can make sure you are compliant by explicitly telling your visitors that you display advertising via a 3rd party and that the advertiser may use behavioural retargeting. If the visitor agrees then great, if not then you may wish to turn advertising off or refuse entry to your site. Advertising is your business model after all and you do NOT need to allow anyone onto your site if you dont wish to!
The ICO also made it clear that there are many different levels of cookie and data collection and there could well be a huge difference between a visitor who has chosen to come to your site and is then shown content that is more relevant to them to assist in the normal use of that site, than behavioural advertising on Site A that promotes Site B.
I believe that once all major browsers enable the do not track, or equivalent features and as long as you ensure you treat the differing implementations and specs of those systems effectively, always honouring when someone has these settings turned on, then you will be compliant with the implementation. I should stress though that you should ALWAYS detail in your privacy policy what you do with data, how you collect it and what you collect it for, and give everyone the ability to say “no thanks” – Don’t forget that this includes things such as analytics or other packages. Data is data, it doesnt have to be solely behavioural advertising.
What I think is a very good clue as to how strongly the ICO will act in enforcing the new regs is shown by the ICO web site itself. Currently the ICO uses 3rd party tracking via Google Analytics. How do I know this, well the ICO privacy policy tells me so as well as shows me how to opt out.
But …. I wasn’t asked before I reached the ICO site and didn’t give explicit pre informed consent before I was recorded as visited in the Analytics package. I had to land on the site, search for the privacy policy (or privacy notice as the ICO call it) and then click through and read it there.
If it’s good enough for the goose……..
N.B. Please do not take any of the above post as representing anything other than my personal views. They do not express anything other than some ramblings from a British online marketer, do not express the views of any companies I work for, with, have previously worked with, will work with in the future nor any other thing that I have ever spoken to or with. They words above are my views only and if you are in any doubt then please take independent legal advice, preferably from a competent information and data specialist lawyer. Having said that, I doubt they’ll say much different than I have above
This entry was written by , posted on 09/05/2011 at 7:59 pm, filed under Everything. Leave a comment or view the discussion at the permalink and follow any comments with the RSS feed for this post.





