In the near future there will be new rules on the use of certain types of internet cookies, as a result of amendments to the Dutch Telecommunications Act. The amendments are intended to implement an EU directive and should be in force by 25 May 2011.
What are cookies?
Cookies are used to store products in an online shopping cart and to remember language (and other) preferences, as well as for behavioural advertising, i.e. the placing of targeted ads on the basis of, for example, internet surfing behaviour.
New legislation further to EU directive
In principle, the new rules will not have any consequences for the first two activities mentioned above, provided that they are carried out solely for the purpose of performing the communication or providing a requested service. However, behavioural advertising will only be permitted if clear and complete information is provided in accordance with the Dutch Personal Data Protection Act and in any event – regardless of the type of data which are processed – about the purposes for which cookies are used. This information should be understandable and easy to find. An inconspicuous link to this information at the bottom of the website (that can only be viewed by scrolling down) is insufficient.
In addition, the visitor's consent must be obtained (an "opt-in" system). The drafters of the bill acknowledge that it would be impractical to request such consent, for example using a pop-up screen, each time a website containing cookies is visited. However, it is also not possible to obtain the visitor's consent through his/her browser settings; at least, not in all cases. To date, the question of how this should be resolved remains unanswered. The drafters state that it should be discussed – also at European level – with trade and industry, as well as with consumers, how the consent and information requirements can be practically complied with. Many recent initiatives appear to be "opt-out" systems, however, which would not (seem to) suffice.
The deadline for implementation of the directive containing the above rules would be 25 May 2011.
The bill and other parliamentary documents (in Dutch) can be found by searching for "32549" on the website zoek.officielebekendmakingen.nl
Recent developments
A study was recently conducted by TNO and IViR by order of the OPTA, the supervisory authority with respect to the Telecommunications Act. The researchers are of the opinion that the current rules already apply an opt-in system (i.e. the visitor's consent is already required), because they require the provision of information in advance and the offering of the right to object. Almost immediately, the relevant industry sectors responded that this interpretation would be incorrect. In addition, they proposed the use of a universal EU icon in online ads, to be linked to a universal landing page where cookies would be visible and could be deactivated. A requirement to this effect could be incorporated in the Dutch Advertising Code, thus applying to all companies. Hopefully, this proposal will be embraced on both the Dutch and European levels.
Article 29 Data Protection Working Party
In June 2010, the Article 29 Data Protection Working Party, which is an EU advisory body, published an opinion on behavioural advertising in which it stated – in short – that the visitor's consent is required for behavioural advertising activities, and that this consent cannot in all cases be obtained through the visitor's standard browser settings. The working party's opinion can be accessed by clicking on the following hyperlink:
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp171_en.pdf
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp171_nl.pdf
To be continued! We expect practical guidelines on this topic in the near future, but given the deadline of implementation thought it would be helpful to send you this newsletter already.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
