New EU legislation that covers online privacy will pass into EU law in May 2011. There are some concerns that as a result of this legislation, some forms of behavioural advertising will no longer be permissible. After consulting with the leading players in the industry (including the IPA, IAB, Google & Specific Media) over the last 12 months, we are hopeful that this legislation will not have a significant impact on the practice, but will simply further enhance the requirements to conduct behavioural advertising in a reputable manner (see www.youronlinechoices.co.uk).
The situation still certainly requires close monitoring, because it is still a little uncertain how the UK Government (and the Governments of other EU territories) will enforce the legislation; although we hope for them to be very flexible. Over the next few months we will find out more detail on this, as the final recommendation on this is published.
Further detail on the background to this legislative development can be found below. To discuss this matter further with Equi=Media, please get in touch.
The new e-Privacy Directive (2009/136/EC) is due for implementation on the 25th May 2011. The directive originally required that companies sought consent from the public for the use of their data for a service “expressly” requested.
Recital 25 of the preamble recognizes the importance and usefulness of cookies for the functioning of the modern Internet and directly relates Article 5(3) to them but Recital 24 also warns of the danger that such instruments may present to privacy.
The article is technology neutral, not naming any specific technological means which may be used to store data. This reflects the EU legislator’s desire to leave the regime of the directive open to future technological developments.
The addressees of the obligation are Member States, who must ensure that the use of electronic communications networks to store information is only allowed if the user is provided with “clear and comprehensive information”, in accordance with Data Protection Directive, about why the information is being processed and is offered the right to opt out.
The regime so set-up can be described as opt-out with an added information request. This effectively means that the consumer must be given the opportunity to opt out of receiving cookies. The Directive does not give any guidelines as to what may constitute an opt-out, but broadly it was acknowledged that a browser cookie setting function should amount to the mechanism for consent.
In the summer of 2010 the Article 29 Working Party started to consider the e-Privacy Directive and its implications to protect data. This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data protection and privacy made up of the data protection regulators from the EU's 27 member states. Its tasks are described in Article 30 of Directive 95/46/EC and Article 14 of Directive 97/66/EC.
From “directives” issued to initial consultation, there was a “rush of panic” as the working party produced a solution that required that the public to “expressly opt in” to receive cookies. They did provide some indication as to how this might work but left it fairly non-prescriptive and recognized that the industry would have to carry a heavy burden to meet this type of regulation. (It is ultimately up to each countries interpretation of the e-privacy directive to implement mechanics forward).
The consultation period closed in December after much representation from the industry. A final recommendation on how e-privacy is implemented has yet to be made with the 25th May rapidly looming. One point of note is that the term “expressly” opt in was removed at the closure of the consultation period. There is some debate as to what “consent” might look like but without a final publication of the how each country should implement processes that protect the public it is impossible to second guess a likely outcome on what this means for behavioural and cookie based data gathering for marketing purposes. A ban is very unlikely as the majority of internet users and the industry would be deemed as going backwards by most EU member countries. It really is a case of “watch this space”!