After frantic lobbying by the digital marketing industry, the long awaited EU Communications Data Protection Directive is softer on cookies than it was and than current UK law as interpreted by the Information Commission.
Who: The European Parliament
When: 30 May 2002
On 30 May, however, following strenuous lobbying by the industry through bodies such as the Interactive Advertising Bureau, Euro MPs voted for a watered down rule.
Here is the change. The old wording is in italics, the new is in bold type. The unchanged wording is in ordinary type. Activation of a cookie is to be "only allowed on condition that the subscriber or user concerned receives in advance is provided with clear and comprehensive information [about the cookie] and is offered the right to refuse such processing by the data controller".
The next milestone on the way to the Directive being finally adopted and becoming law across Europe is consideration of the Directive by the EU Council of Ministers in June 2002 with a view to its being adopted. After this, the Directive should be finally published in July 2002 with a view to its becoming law in all EU member states by October 2003.
Why this matters:
It is interesting to compare these much-publicised developments at the European level with the position here in the UK. Here, the Information Commission has long held the view that under the Data Protection Act 1998, cookies can only legally be activated after a cookie warning has been given and an opt-out opportunity provided, in other words, a position exactly the same as that threatened for the whole of Europe until the 30 May vote.