The Dutch Telecommunications Act was recently amended. The Act now includes a controversial provision on tracking cookies. These are small text files that a website can place on the computer of a visitor. Handy, because the credentials or preferences of the website visitors can be mapped. The cookies can also track the surfing habits of a user. Useful for advertisers, who can precisely identify which websites a user visits. By doing so, the advertiser can offer custom-made ads (behavioral targeting).
The 'update' of the Act is based on the European ePrivacy Directive. The adjustment was done by the Netherlands in a stricter way than the Directive requires. Under the Directive, placing and reading cookies is allowed if the Internet user has been informed in advance. And if he has given permission. However, it remains unclear how this permission should be given. For example, is it possible to grant permission in the browser settings (opt-out)? Or should the user via an active act indicate that he allows cookies before they are placed (opt-in)?
The Cookiewet states: in case cookies are placed and used for the analysis of surfing behaviour, it is assumed that the installer collects personal information. Evidence against this presumption is however possible.
The Data Protection Act applies to the collection of data. This Act contains several additional obligations such as unambiguous consent - unless it can be proved that no personal information is being collected. Parties that unstall cookies must get explicit permission of internet users in order to be allowed to collect their data. For now, the Dutch Regulatory Authority must provide evidence that the cookies collect personal data. From 1 January 2013 this will change: then the cookie-provider itself must prove the cookie does not collect data. The reason for this 'delay' is because it is difficult to demonstrate whether the cookies really collect personal information. The industry is working on a Do-Not-Track standard that allows Internet users to indicate at once that advertisers may not use tracking cookies. When that standard is ready, is the question.
Daan van Eek, intellectual property lawyer
|
office Emerald House Jozef Israëlskade 48-G Amsterdam, the Netherlands t +31 (0)20 - 305 3066 www.hoogenhaak.nl |
post PO Box 76780 1070 KB Amsterdam e info@hoogenhaak.nl f +31 (0)20 - 305 3069 chamber of commerce 34314579 |
The Dutch Telecommunications Act was recently amended. The Act now includes a controversial provision on tracking cookies. These are small text files that a website can place on the computer of a visitor. Handy, because the credentials or preferences of the website visitors can be mapped. The cookies can also track the surfing habits of a user. Useful for advertisers, who can precisely identify which websites a user visits. By doing so, the advertiser can offer custom-made ads (behavioral targeting).
The 'update' of the Act is based on the European ePrivacy Directive. The adjustment was done by the Netherlands in a stricter way than the Directive requires. Under the Directive, placing and reading cookies is allowed if the Internet user has been informed in advance. And if he has given permission. However, it remains unclear how this permission should be given. For example, is it possible to grant permission in the browser settings (opt-out)? Or should the user via an active act indicate that he allows cookies before they are placed (opt-in)?
The Cookiewet states: in case cookies are placed and used for the analysis of surfing behaviour, it is assumed that the installer collects personal information. Evidence against this presumption is however possible.
The Data Protection Act applies to the collection of data. This Act contains several additional obligations such as unambiguous consent - unless it can be proved that no personal information is being collected. Parties that unstall cookies must get explicit permission of internet users in order to be allowed to collect their data. For now, the Dutch Regulatory Authority must provide evidence that the cookies collect personal data. From 1 January 2013 this will change: then the cookie-provider itself must prove the cookie does not collect data. The reason for this 'delay' is because it is difficult to demonstrate whether the cookies really collect personal information. The industry is working on a Do-Not-Track standard that allows Internet users to indicate at once that advertisers may not use tracking cookies. When that standard is ready, is the question.
Daan van Eek, intellectual property lawyer