European Data Protection Board issues statement on the revision of the e-Privacy Regulation

-Background-
On 28 May 2018, the European Data Protection Board (EDPB), the body in charge of the application of the General Data Protection Regulation (GDPR) which came into force on 25 May 2018, released a statement stating that the use of so-called “cookie walls” should be prohibited under new EU e-Privacy rules.

A new e-Privacy Regulation was proposed by the European Commission in January 2017, but the text has yet to be finalised. The Regulation is intended to replace the E-Privacy Directive (2002/58/EC) to regulate the privacy of electronic communications. The EDPB welcomes many aspects of the Regulation, including the extension of its scope to over-the-top (OTT) providers and to communications between "internet of things" devices. However, the EDPB also has key concerns, in particular “cookie walls”, which enable website operates to make access to their sites conditional on cookie consent.


-Cookie Walls-
Cookies are small text files that are created when a user visits a website that uses cookies to keep track of their movements within the site and any information given. The site then “knows” the user and will record browser visits and activity, with online retailers benefiting from using cookies to keep track of the items in a user’s shopping cart. EU law has required websites that use cookies to seek user permission to do so and “cookie walls” have been a means of achieving such consent. They involve a user being confronted with a pop-up window requiring them to click accept to give consent for their data to be used and stored in order to have access to the website’s content. By consenting, the website can use the user’s cookie data for tracking purposes such as ad targeting.

The EDPB stated that permitting the use of cookie walls would run contrary to the GDPR; “in order for consent to be freely given as required by the GDPR, access to services and functionalities must not be made conditional on the consent of a user to the processing of personal data or the processing of information related to or processed by the terminal equipment of end-users, meaning that cookie walls should be explicitly prohibited”.

The direct reference to cookie walls by the EDPB in this statement means that a digital marketer will have to take into consideration the effect of cookie-related changes on advertising. Given the clear message that cookie walls will not be permitted in any guise, service providers must look to offer a technical solution to obtain a valid consent.


-Comment-
The imminent new e-Privacy Regulation is a complementary and effective measure to the EU’s privacy and data protection framework, as it provides specific protection regarding the processing and confidentiality of electronic communications data. However, at the same time, the EDPR has concerns whether the Proposal, as it stands, can in fact deliver on its promise to ensure a high level of protection of privacy in electronic communications. The EDPB’s desire to ban cookie walls clearly demonstrates that websites are mandated to offer users a genuine, freely given clear choice regarding the processing of their data, as required under the GDPR.

The EDPB also emphasised that the new strict e-Privacy rules should apply to not only traditional telecoms companies, but also to operating systems of smartphones, tablets, or any other ‘user agent’, such as WhatsApp, Facebook Messenger, Skype and Gmail. In addition, the new rules must also set strong requirements for privacy by design and by default.
For further information, please contact Koichiro Nakada – Head of Japan Business Group (koichiro.nakada@lewissilkin.com) and Yoko Nakada - Senior Associate, Deputy Head of Japan Business Group (yoko.nakada@lewissilkin.com).
Disclaimer
The information and any commentary on the law contained in this bulletin is provided free of charge for information purposes only. No responsibility for its accuracy and correctness, or for any consequences of relying on it, is assumed by Lewis Silkin LLP or Centre People Appointments. The information and commentary does not, and is not intended to, amount to legal advice and is not intended to be relied upon. You are strongly advised to obtain specific, personal advice from a lawyer about your case or matter and not rely on the information or comments in this bulletin.

This information is supplied by Lewis Silkin LLP www.lewissilkin.comm

Article top