EU cookie law interpretation is breathtakingly stupid!

I read the out-law blog post late last night as it was retweeted by @eivindsavio in Norway from @pierrefar in the UK. To be honest, I didn’t think much of it as I had just reviewed Vivane Reding’s EU Telecoms Reform and had blogged about it a couple of hours prior to that after thorough review. After all, I had been writing about the possible threats of both HADOPI in France but also PHORM in the UK, wondering why Mrs. Reding was taking a stance against PHORM while keeping quiet about HADOPI.

It turns out I was wrong as she was fighting one battle at a time, which makes total sense when you need to find unanimous consent of 27 member states.

So basically, what are we talking about?

Back in November 2007, the Commission adopted proposals for the reform of the EU telecoms rules. It took some time for all parties to come to an agreement as it finally fell on November 5th 2009, after much debate. As mentioned, I blogged about the outcome but chose to mainly discuss it from the standpoint of banning HADOPI’s “three-strikes law”. The reason why I chose to do this is because this “three-strikes policy” is an infringement of the basic principals of democracy, as presumption of innocence and the right to privacy is not respected.

Now, this post also talks about the “cookie affair” as the EU Telecoms Reform states “Internet users will be better informed about cookies and about what happens to their personal data, and they will find it easier to exercise control over their personal information in practice.” Vague!

My recommendation was and still is to adapt privacy policies in order to clearly explain to visitors what cookies are used for and why they are there, while also including an opt-out link as found for example in Yahoo! Web Analytics’ privacy policy.

Now, Mr. Struan Robertson’s article on out-law, of which he is the editor, but also on Techradar are almost the same articles word for word. So this is information coming from the same person, just on two different websites. He mentions that Europe’s cookie law was found at the tail end of an 18-page Council press release, together with some other stuff the Council has been working on. Fair enough.

Indeed, page 17, just after the protection of workers from chemical risks within the Social Policy section mentions under the Telecommunications Policy section the creation of the Body of European Regulators for Electronic Communications (BEREC) as well as the adoption of a directive amending legislation in force on universal service ePrivacy and consumer protection.

More specifically it amends the Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws.

And this is where we come to the root of it – please bare with me – as paragraph 66 states:

“Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities. ”

Again, this remains vague and for the life of me, I don’t read prior consent here but an obligation of information in an as much as possible friendly way. So again, I’m not imagining pop-ups or white pages asking for consent to collect information about the surfing behavior but just a clear privacy policy with an opt-out link like Yahoo! Web Analytics proposes.

Also, it’s not as if this was hushed in any way as it’s exactly what the EU Telecom Reform is all about! Additionally, it’s interesting to note that if indeed we were talking about pop-ups &/or white pages asking for consent of measurement, this would need to be enforced. If this goes into effect, BEREC should move really fast!

But Mr. Robertson’s second article also mentions amendment to article 5(3), which surprisingly I’ve only managed to find in a second reading of the article and not as an official document. So it would be nice if he could point to his actual sources, just for the sake of clarity, as any good legal expert usually does as for me, the official document is still this one (hint: check out 5.3)!

Now, does all this really come as a surprise? I think not as already back in April of this year, Viviane Reding clearly stated that directives would be amended and more specifically Directive 2002/58/EC. But it hasn’t yet, has it?

Storm in a Teacup

And that’s all that this actually is in my opinion: A storm in a (very British) teacup. Nothing new here! Well, except for the second phase of an infringement proceeding over the UK to provide its citizens with the full protection of EU rules on privacy and personal data protection when using electronic communications dated October 29th of this year send out by? you’ve guessed it! Mrs Reding …

Last but not least, I would like to mention that Mrs. Reding’s DG Information Society & Media has been using Google Analytics for some time now. I should know as I helped them implement it and raised the privacy issues during the project!

What’s however interesting is that, as of today, I still haven’t found the possibility of opting-out from Google Analytics, but that’s another debate.

Enforcement? Unlikely

I don’t think that prior consent for the use of cookies will be enforced in Europe and I believe it’s just a misinterpretation intended to get attention…

Once again, I welcome comments and thoughts as I’m totally open for discussion in order to make sure that the Europe I was raised in and choose to live in upholds to my standards of a righteous society.

Posted Tuesday, November 10th, 2009 | 15 responses | Add a Comment | Share, Save or Email