The Web is now covered with poorly designed, intrusive and ineffective dialogs warning about cookies.
Presumably this is as a result of an EU directive. Which UK law enacts this directive?
3
-
1This appears to be a question about laws themselves, not about the politics and political processes which create them. This makes this question more appropriate for Law Stack Exchange than Politics Stack Exchange.– PhilippCommented Nov 12, 2018 at 12:25
-
itgovernance.eu/blog/en/how-the-gdpr-affects-cookie-policies– user0306Commented Nov 12, 2018 at 13:01
-
2@DVK We had these "this site uses cookies" warning before the GDPR. The GDPR just extended it.– PhilippCommented Nov 12, 2018 at 13:06
Add a comment
|
3 Answers
As SJuan76 mentions in a comment, the first cookie-related EU law was:
Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws
This being an EU Directive, it required transcription into UK law to be valid in the UK. This was effected by:
The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011
This is a statutory instrument made under the European Communities Act 1972, and came into force on 26 May 2011.
answered Nov 12, 2018 at 15:47
It is not a directive, it is a regulation
More specifically, it is the General Data Protection Regulation, or GDPR; we even have a tag for it.
Now to the core of the question, GDPR being a regulation and not a directive means that it enters into effect without need of national Parliaments to adapt their laws to enact it. Or, as the GDPR FAQ page explains
What is the difference between a regulation and a directive?
A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the the previous legislation, which is a directive.
In any case, some aspects of the GDPR1 are left to the national Parliaments to decide. In the UK there is the Data Protection Act of 2018
1For example definition of what is the age limit for "minors" or if permission is enough to process highly sensitive data like health data.
-
1Thank you. The “cookie law” was in effect well before GDPR. Does this mean GDPR incorporated, superseded or extended it?– 52d6c6afCommented Nov 12, 2018 at 13:19
-
GDPR incorporates many provisions that affect cookies, as those can be used to gather personal data (e.g. if a cookie tracks which pages you visit in order to sell publicity then GDPR stipulates that consent is needed), but does not focus on them. It does not supersede or extend the cookie law (i.e. it is not derived from it) but it forces additional constraints.– SJuan76Commented Nov 12, 2018 at 13:46
-
Thank you. Do you know what regulation or directive imposed the original cookie law?– 52d6c6afCommented Nov 12, 2018 at 13:52
-
2AFAIK it would be the 2009/136/CE directive, which ammended directives 2002/22/EC, 2002/58/EC and regulation No 2006/2004. It seems that one issue is that it asked for "consent" but it not required it to be "explicit" (i.e. it could be argued that as long as there was a way of rejecting the cookies and the user did not use it there was consent), This is one of the reasons why the GDPR (that in no uncertain terms requires explicit consent) has led to all those dialogs.– SJuan76Commented Nov 12, 2018 at 14:04
SJuan76's comment from a different angle:
GDPR incorporates many provisions that affect cookies, as those can be used to gather personal data (e.g. if a cookie tracks which pages you visit in order to sell publicity then GDPR stipulates that consent is needed), but does not focus on them. It does not supersede or extend the cookie law (i.e. it is not derived from it) but it forces additional constraints. – SJuan76 3 hours ago
Basically, the Cookie Directive and GDPR operate on 2 different levels, which might overlap: we can say that GDPR applies only as long as the cookie is collecting data considered "personal" or "online identifiers" by the Regulation. If it happens, then the consent window (you called it "dialogs warning") has to be more strict, as per GDPR requirement (I am just mentioning one of the effects). Otherwise, the less-strict Directive will apply.
