Cookies in EU continued

16.10.2012    Vendula Peřinová   

As we have already sketched, question marks on the new EU cookie directive have appeared lately in the digital community. We got many answers but we had to investigate what it is all about on our own. The result is an article for Marketing&Media Magazine.

The cookie directive in the Czech Republic

The issue of the EU directive in the Czech Republic was explored by Daniel Dočekal, Jiří Peterka and by other bloggers interested in this matter. However, the majority of the facts and thoughts on the matter referred only to the year 2011 when the directive came into force (with one year delay) and the year 2012 when a plenty of comments (especially in GB) showed up. The comments dealt with the consequences of the directive’s violating which could lead to a penalty up to £500,000. On the other hand, we haven’t learnt much about the implementation of the directive into the Czech legal system. The information leads only to the approval process of the E-communication Act which doesn’t mention how the web providers should give notice about the cookies. For that reason, our investigation led us to the gestor himself (at the Ministry of Industry and Trade) who is responsible for the implementation of the EU directive.

We expected a rather complicated interpretation of the directive or a really bad scenario concerning the Czech Internet advancement. Surprisingly, we were given a simple result by the director of digital economics Ing. Mgr Jaromír Novák. The result follows from the EU directive’s wording, precisely from its recital number 66 which says: “Where it is technically possible and efficient, in accordance with Directive’s 95/46/ES relevant provisions, the user’s consent to the personal data processing may be expressed by a proper browser or other application settings.” Some of the EU countries including the CR stick to this wording which might contradict basic provisions of Directive 2009/136/ES.

Moreover, existing way of saving cookies based on the opt-out principle is considered as a suitable browser setting. It is a very smart solution because it easily exploits the directive’s gaps. The good thing about the gap is that we don’t have to worry about breaking the law. Nevertheless, one should not forget that E-communication Act is valid. According to article 89, section 3, the user has to be demonstrably informed in cases when his or her data are being saved in favour of the website owner, excluding cookies that are necessary for overall service’s facilitation transfer and service functionality, which a participant explicitly requires. In addition, the implementation of this wording into the websites is not strictly specified or complicated as it might seem. The basis is the information about cookies’ properties – e.g. what they are used for and how to block them in the browser settings in case of disagreement. In addition, privacy settings can be found in Privacy Policy or Trade Terms.

Sceptical and conservative cookies future

Nowadays, the Internet is considered not only as one of the best measurable media but also the media with an exact market reach. Cookies play their role because they help to identify given user, follow his or her track and actions on the particular website as well as save login data, information about shopping cart or they can help to target advertising. Moreover, if we ever had to implement the directive in full extent into the Czech legal system, this basic characteristic and absolute advantage of the Internet would be limited. This is particularly worrying to sceptic public due to the fact that pop-up windows will make users very sensitive to them and that they will discourage them from accepting cookies. However, the more realistic scenario is that we all will get used to it and we will use the Internet the same way as we do now. Some may consider the extra mouse click as a slight downgrade of the UX (user experience), more sceptical ones may consider it as a pointless idea of the EU. On the other hand, the realistic people are certain that a loose interpretation of the act is a key to giving oneself full play.

Some notes on the EU e-Privacy Directive

The EU directive 2009/136/ES was established in order to protect user’s privacy and prevent him/her against monitoring. The amendment of the e-Privacy Directive of 2009 set the implementation deadline for May 25th 2011, however, in May 2011 the legal force of the amendment was delayed for 12 months which should serve as websites’ preparatory period to the particular resolution.

Heretofore, the website’s setting was based on the opt-out principle which required explicit user’s consent to saving cookies. Moreover, the user was able to set his/her browser not to save the cookies but the new EU directive has changed it. Nowadays, the websites are based on an opt-in principle which means that firstly we need user’s consent and then they will be able to use the cookies in full extent.

Moreover, “member states shall ensure that the storing of information or the gaining of access to already stored information is allowed only in the end user’s or a subscriber’s equipment on condition that the user or the subscriber gave his/her consent after all the necessary information was given to him or her which is in accordance with Directive 95/46/ES, apart from the purposes of processing...”

As mentioned, the recital number 66 not only creates a diversion from the above definition but also gives hope to marketers, PC enthusiasts or to analysts that the digital world will still remain unchanged for some time.

In addition, GB, Latvia and Lithuania are the countries which have seriously taken the directive into account. You can find a plenty of links to useful plug-ins requesting for the user’s consent on various blogs. Some speculations are going on also among the browser’s providers so that they should adjust their browsers the opposite way they do now, meaning to adjust their browsers not to accept the cookies. Nevertheless, it is important to note that the directive’s terms have been being met only by a mere number of countries which accepted the directive, however, the controlling authorities have been benevolent so far and have not imposed any sanctions yet.