Data Protection Update: Cookies and Statistical Data

The UK's ICO (Information Commissioners Office) has apparently made significant last-minute relaxations in its guidance regarding changes to the new EU cookie law. Separately, ESOMAR and EFAMRO have attended meetings of the Council of Europe regarding EU data protection plans.

The ICO surprised many with the update, published on its blog on Friday (25th May), the last working day before the law was due to come into force. The organisation had previously said that 'Implied consent' was unlikely to satisfy the EU but the new comments 'clarify' the commissioner's position on this, suggesting that implied consent can be a valid form of consent in the context of the revised rules on cookies. Site owners relying on implied consent must be satisfied that their users understand that their actions will result in cookies being set, and should not rely on their having read hard-to-find or hard-to-understand privacy policies. Where sensitive personal data such as health information is being collected, site owners 'might feel that explicit consent is more appropriate'.

Quoted on www.thedrum.co.uk , Stephen Groom, Head of Marketing and Privacy Law at Osborne Clarke, said the changes were 'a striking shift in how ICO says it will tackle compliance' and opined: 'Although this new, pragmatic approach is undoubtedly more business-friendly, ideally it would have been good to have had earlier visibility of this dramatic change. It also remains to be seen whether this puts the UK out of step with Brussels and most other EU states.' The UK government gave businesses a year-long grace period, now concluded, to get their sites compliant - they can be fined up to £500,000 for a breach.

Web site: www.ico.gov.uk


Separately, worldwide research organisation ESOMAR said last week it had accompanied partner body EFAMRO in attending a Council of Europe special hearing on the revision of the international legally-binding Convention 108 on data protection, to promote the views of the research industry. Council of Europe member states will get an Explanatory Memorandum for use in interpreting data protection law in June, and this is expected to include provisions specific to research.

Convention 108 concerns the protection of individuals with regard to automatic processing of personal data, and could affect market, social and opinion research in 47 countries in Europe and beyond, say the organisations - and this would cover traditional face-to-face market, social and opinion research as well as digital.

ESOMAR and EFAMRO's paper highlights the importance of maintaining specific rules that apply to research, including the existing 'helpful' 1997 recommendation on protection of personal data collected and processed for statistical purposes; and of aligning the CoE and EU work to ensure consistency and legal certainty for research businesses. Other organisations urging particular research-related points of view included the University of Oxford, the International Chamber of Commerce (ICC) and twelve Member States of the CoE, plus a range of media organisations concerned about the impact on freedom of expression in the media.

The revision process for the Convention should be completed in early 2013.

Web sites: www.esomar.org and www.efamro.org .

All articles 2006-23 written and edited by Mel Crowther and/or Nick Thomas, 2024- by Nick Thomas, unless otherwise stated.