What many marketers had feared has become a reality: on 9 May 2012 the Upper House of Parliament ratified the revised Telecommunications Act, including a disputed clause pertaining to tracking cookies. A cookie is a small text file that is stored on the computer hard disk when a user visits a website. The cookie allows the website to recognise the visitor, for example by storing login details and keeping track of user preferences. Tracking cookies make it possible to track a user’s browsing behaviour. They allow advertisers to know exactly which websites a user visits, so they can tailor advertisements to user preferences. An unwary user who spends an evening looking for hotels in Paris could end up being plagued for weeks by banners advertising Parisian hotels.
Dutch law had to be harmonised in accordance with the European ePrivacy Directive, but the new Dutch legislation is even stricter. The EU Directive allows sites to store and read cookies if the Internet user was informed in advance, and has granted permission. But it’s not clear how that permission is granted. Is it all right to arrange it through the browser settings (opt-out)? Or is active consent required before cookies are stored (opt-in)? The new legislation contains a legal assumption: if cookies are stored to analyse browsing behaviour, it is assumed that personal data is being collected. That action is subject to the Data Protection Act, including all sorts of extra obligations such as unambiguous consent (opt-in). Consent is only exempt from being unambiguous if the ‘collector’ proves that the data concerned is not personal data. This reversal of the burden of proof is not in the Directive.
The Directive should have been implemented last May. In order to avoid a fine from the European Commission, the new regulation will enter into effect immediately. There is still a short run-up period before the burden of proof is reversed: that aspect will not apply until 1 January 2013. Until then, unambiguous consent only applies if the regulator shows that cookies contain personal data. The reason for this ‘postponement’ is the development of a Do-Not-Track standard at the European level. That allows users to state once and for all that advertisers are not allowed to use tracking cookies. It is uncertain whether this standard will be established in time.
Kim Braber
|
office Emerald House Jozef Israëlskade 48-G Amsterdam, the Netherlands t +31 (0)20 - 305 3066 www.hoogenhaak.nl |
post PO Box 76780 1070 KB Amsterdam e info@hoogenhaak.nl f +31 (0)20 - 305 3069 chamber of commerce 34314579 |
What many marketers had feared has become a reality: on 9 May 2012 the Upper House of Parliament ratified the revised Telecommunications Act, including a disputed clause pertaining to tracking cookies. A cookie is a small text file that is stored on the computer hard disk when a user visits a website. The cookie allows the website to recognise the visitor, for example by storing login details and keeping track of user preferences. Tracking cookies make it possible to track a user’s browsing behaviour. They allow advertisers to know exactly which websites a user visits, so they can tailor advertisements to user preferences. An unwary user who spends an evening looking for hotels in Paris could end up being plagued for weeks by banners advertising Parisian hotels.
Dutch law had to be harmonised in accordance with the European ePrivacy Directive, but the new Dutch legislation is even stricter. The EU Directive allows sites to store and read cookies if the Internet user was informed in advance, and has granted permission. But it’s not clear how that permission is granted. Is it all right to arrange it through the browser settings (opt-out)? Or is active consent required before cookies are stored (opt-in)? The new legislation contains a legal assumption: if cookies are stored to analyse browsing behaviour, it is assumed that personal data is being collected. That action is subject to the Data Protection Act, including all sorts of extra obligations such as unambiguous consent (opt-in). Consent is only exempt from being unambiguous if the ‘collector’ proves that the data concerned is not personal data. This reversal of the burden of proof is not in the Directive.
The Directive should have been implemented last May. In order to avoid a fine from the European Commission, the new regulation will enter into effect immediately. There is still a short run-up period before the burden of proof is reversed: that aspect will not apply until 1 January 2013. Until then, unambiguous consent only applies if the regulator shows that cookies contain personal data. The reason for this ‘postponement’ is the development of a Do-Not-Track standard at the European level. That allows users to state once and for all that advertisers are not allowed to use tracking cookies. It is uncertain whether this standard will be established in time.
Kim Braber