Not you? Well perhaps you should be.
On May 26th 2012 the moratorium for introducing this legislation runs out and we’re all supposed to be compliant or face a fine of up to £500,000 for not complying properly with The Privacy and Electronic Communications (EC Directive) Regulations 2003, itself based on a European Directive – 2002/58/EC. This was further amended in 2009 to by Directive 2009/136/EC, something which in the words of the ICO “…. included a change to Article 5(3) of the E-Privacy Directive requiring consent for storage or access to information stored on a subscriber or users terminal equipment – in other words a requirement to obtain consent for cookies and similar technologies.
Governments in Europe had until 25 May 2011 to implement these changes into their own law and the UK was no exception. The UK introduced the amendments on 25 May 2011 through The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 and it became law a year ago. But so many businesses were unable to comply with this that a twelve-month moratorium was sought from, and subsequently granted by the ICO.
Now with billions of websites out there questions have been raised about how this will even be policed, and indeed if it is worth doing anything about it at all. And you can see the argument here, as how on earth can anyone check every website in the UK and Europe? And how can you tell if a ‘UK’ website is actually UK based (eBay and Amazon being prime examples…)?
Looking for guidance to the bigger players in the market we’ve recently noticed a pop up following us around the www.bt.com website asking for permission to drop cookies…
We’ve advised all our clients that have enquired that there needs to be a statement about cookies on their website and according to the latest information as long as you have a statement saying that you are ‘working towards compliance’ it should provide some wriggle room.
But what is this actually trying to achieve? Is this simply over regulation for the sake of it?
We understand the importance of privacy and we agree that individuals should have the right to anonymity however this solution looks at the wrong thing. If it must be regulated it should be about regulating the information we as site owners collect about an individual who visits our site but the focus has been entirely on the mechanism that we currently use to do this. So what if a replacement for a cookie is invented? How is this to be regulated? The broad ‘similar technologies’ phrase simply isn’t good enough.
So for now, our advice to clients still stands – do what number 10 has done and you can’t really go wrong, after all, if it’s good enough for them……
If you’re still unsure about cookies and the new law then you can visit the ICO website to find out more or talk to us and we can help