The Web is now covered with poorly designed, intrusive and ineffective dialogs warning about cookies.
Presumably this is as a result of an EU directive. Which UK law enacts this directive?
Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.Sign up to join this community
As SJuan76 mentions in a comment, the first cookie-related EU law was:
Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws
This being an EU Directive, it required transcription into UK law to be valid in the UK. This was effected by:
This is a statutory instrument made under the European Communities Act 1972, and came into force on 26 May 2011.
It is not a directive, it is a regulation
Now to the core of the question, GDPR being a regulation and not a directive means that it enters into effect without need of national Parliaments to adapt their laws to enact it. Or, as the GDPR FAQ page explains
What is the difference between a regulation and a directive?
A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the the previous legislation, which is a directive.
In any case, some aspects of the GDPR1 are left to the national Parliaments to decide. In the UK there is the Data Protection Act of 2018
SJuan76's comment from a different angle:
GDPR incorporates many provisions that affect cookies, as those can be used to gather personal data (e.g. if a cookie tracks which pages you visit in order to sell publicity then GDPR stipulates that consent is needed), but does not focus on them. It does not supersede or extend the cookie law (i.e. it is not derived from it) but it forces additional constraints. – SJuan76 3 hours ago
Basically, the Cookie Directive and GDPR operate on 2 different levels, which might overlap: we can say that GDPR applies only as long as the cookie is collecting data considered "personal" or "online identifiers" by the Regulation. If it happens, then the consent window (you called it "dialogs warning") has to be more strict, as per GDPR requirement (I am just mentioning one of the effects). Otherwise, the less-strict Directive will apply.