Agencia Española de Protección de Datos (AEPD), the Spanish data protection authority, took an important decision which can have bearing on the future of the online advertising sector, the business model of web portals as well as on producers of applications that use tracking mechanisms.

AEPD decided to impose a penalty of €30,000 on VUELING AIRLINES SA following a complaint filed by a user of the website owned by the company. The decision was based on the consideration that the cookie banner was defectively constructed.

Importantly, Vueling Airlines’ website cookie banner contained general information about the purpose of using various types of cookies (required for operation, analytical, marketing), and referred to the privacy policy available on the website for further details. However, it did not give the user a choice as to types of tracking mechanisms he could accept. The cookie banner offered only an option to acknowledge that they exist or reject them by adjusting the settings of the user’s browser.

The complainant claimed that he had no possibility of making an informed, granular choice of the mechanisms tracking the session. Furthermore, he argued that personal data was provided to unknown third parties and that reference to browser’s settings that do not provide full options of configuration did not ensure sufficient freedom of choice. The authority seconded the arguments and further expanded them in some points, and, following an inspection, imposed the highest administrative penalty allowed under Spanish law for the said breach, i.e. €30,000.

The decision is in line with the administration of justice pursued by the Court of Justice of the European Union on overly narrowing options as regards use of tracking mechanisms. This particularly refers to the recent ruling handed down in the case of Planet 49 prohibiting “tacit consents”, however, not referring to them directly.

In our opinion, Polish law provides the supervision authorities with similar entitlements to question the current, widely followed practice of using generally worded cookie banners, which do not allow the user to choose the applied tracking mechanisms. The Polish Telecommunication Law provides sanctions for this breach, amounting to 3% of annual revenue.

Please contact our Intellectual Property, Technology and Communications team if you are interested in receiving more information on, but not limited to:

  • How to construct cookie banners, option selection panels in applications and privacy policies to avoid the risk of a similar charge,
  • Why the decision is so important to the website advertising sector and why the effects are more far-reaching than the amount of the penalty itself,
  • Whether we can count on the e-Privacy Regulation to clarify the principles of applying the tracking mechanisms.

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.