Can consent to cookies be expressed through web browser settings or other applications?

Transcription

1 Belgium - No information on this. The draft ordinance of 1 July 2011 is not a public document No No information on this. The draft ordinance of 1 July 2011 is not a public document. - Council of Ministers approved a draft text on 1 July Draft text expected to be sent to Parliament in October 2011 Czech Republic - No, the draft legislation maintains the right to regime. - The only proposed change is to delete words carrying out or facilitating from the second sentence of the old Article 5(3) No N/A - Government proposal from 5 May 2011 (ref. no. 347) - First reading took place on 15 June 2011 with a second reading scheduled for 20 September The draft legislation is very unlikely to become effective law before November 2011 Finland Yes 25 May 2011 Yes - The amendment is implemented in the Act on the Protection of Privacy in Electronic Communications, 1516/2005, as amended, (S hk isen viestinn n tietosuojalaki). The rules on cookies are incorporated in 7. France Yes 26 August 2011 Yes - However, in the CNILs view, browser settings accepting all cookies without distinguishing their purpose cannot be regarded as validly expressed consent. - Pursuant to Article 17 of Law no of 22 March 2011, implementation of the Directive 2009/136/EC has been delegated by Parliament to the Government - The amendment is implemented in the ordinance of 24 August 2011 n relating to electronic communications

2 - No guidance from the CNIL. However, in a public statement on its published on the CNILs website, the authority considers that browser settings accepting all cookies without distinguishing their purpose cannot be regarded as validly expressed consent Germany Still unclear No Unclear - Governmental draft legislation aimed at amending the German Telecommunications Act (TKG) has been submitted to Parliament. The draft recognises the risk of cookies being used to create user profiles but it has not yet been suggested how to implement Article 5(3) of the Directive. - Until recently, German Federal Government (Bundesregierung) said it wanted to wait for (and take into account) the results of the Europeanlevel consultations currently taking place. - In August, however, the German Federal Government confirmed (as part of a response to an inquiry filed by Members of Parliament dated August 3, 2011, see BT-Drs. 17/6765) that it now intends to implement Article 5 para. (3) of the Directive by

3 inserting revised language in the above mentioned draft amendment of the TKG. - In June 2011, the Bundesrat (Upper House, where the German Federal States are represented) introduced draft legislation (BR Drs. 156/11) with amendments to the German Act on Telemedia (TMG), which inter alia contain a provision (Section 13 para 8 TMG) requiring that users shall be informed and asked for their consent prior to the storage of any data on an end-users device and/or any remote access to those data - This draft provision has raised substantial criticism for being too broad and is not considered to qualify as an implementation of the Directive - The German Federal Government appears to object to the Bundesrat's initiative and announced it will address the subject matter of cookies in the draft amendment to the TKG (see above). Hungary Opt in - No - The draft legislation does not mention Recital 66 of 3 August 2011 No - The draft was submitted to Parliament on 10 June 2011 and it was accepted on 11 July The

4 the Directive relating to applications - In addition, consent should be obtained prior to the storage of data and access thereto Italy Opt in - No information on this. Draft legislation not yet publicly available Netherlands - No - Draft legislation stricter - For the use of so-called first-party cookies to recognise users or subscribers when visiting websites relating to financial transactions, the user needs to give consent - To place third party cookies and tracking cookies, the user or subscriber needs to give amendment was signed by the President and published in the Official Gazette - The cookies clause already required consent after clear and comprehensive information No - No public consultation No Yes but the current version of the browsers do not make the distinctions required by the draft legislation regarding cookies. Therefore, at present, browser settings cannot be considered as sufficient to express consent. - Implementation of the Directive 2009/136/EC is to be delegated by Parliament to the Government. Based on the most recent update publicly available, the law delegating implementation to the Government is not yet in force - The law needs approval from the Senate (anticipated in September) to enter into force - The Senate s role in practice is limited to voting on the entirety of the legislation rather than considering individual provisions - The Senate will decide shortly on the procedure, i.e. whether it will vote with or without a debate - If the law is approved by the Senate, it will enter into effect on 1 January 2012

5 Poland Slovakia unambiguous consent - To process sensitive data suitable for monitoring surfing behaviour on the internet (for example, regarding behavioural advertising) explicit prior consent must be given by the subscriber or user - No, the draft legislation maintains the right to regime - The only change relates to the information given. The user must be informed (unambiguously, and in an easily understandable manner) prior to placing the cookies about; (i) the purpose of storing cookies, (ii) the manner of using the content of cookies, (iii) the period of storing and having access to them, (iv) the name of the processor of stored data Yes 1 November 2011 Yes Pursuant to the current draft legislation N/A - Draft legislation was prepared by the Ministry of Infrastructure 13 July The proposals are currently under consultation by the government - The proposals have not made it before Parliament yet (the Polish Parliament is currently in the midst of elections a new Parliament and Government should be elected by November) - The draft is currently in the Slovak Parliament in the second stage of the

6 legislative process. - Rules for cookies are contained in section 55 (4) of the Draft Act on electronic communications - The wording of the draft could potentially still be amended in the course of the legislative process. - The legislation has been signed by the Slovakian President on November 13 th Spain - Broadly although consent to cookies expressed through web browser settings requires that the recipient actively configures them. This goes beyond the wording of Recital 66 of the Directive. No Yes provided that the recipient actively configures his browser settings to give consent during installation or update - The government published a draft proposal for Parliamentary consideration - The deadline for amendment was 5 July 2011 and several amendments were proposed - The draft proposals are the subject of a report expected from the Parliaments Industry Commission - No date has yet been fixed for adoption Sweden Yes 1 July 2011 Unclear. The section regarding cookies has been relatively vaguely written and gives room for differing interpretations. In doing so, the legislature has in part handed over responsibility for developing customs and - The Directive is implemented through amendments to the Electronic Communications Act (Swe: Lag (2003:389) om elektronisk kommunikation)

7 guidelines for gathering consent to industry. UK - Broadly - The UK legislation only refers to the word subscriber. There is no reference to users. - Consent to the use of cookies expressed through web browser settings requires that the recipient actively configures the browser. This action goes beyond the wording of Recital 66 of the Directive. 26 May 2011 Yes, but only if consent is signified by a subscriber who amends or sets controls on the internet browser. This would not cover an internet user who makes no change to the default browser settings. - The Directive is implemented through the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations The ICO published a Guidance entitled Changes to the rules on using cookies and similar technologies for storing information - Operators have been given 12 months to comply with the new requirements - In addition to browser settings or other applications, consent can also be expressed through programme in direct reference to industry standards aimed to collect and manage consent.

8 Contact Us Ruth Boardman Partner +44 (0) Gabriel Voisin Associate +44 (0) Laura Acreman Associate +44 (0)