3

The Web is now covered with poorly designed, intrusive and ineffective dialogs warning about cookies.

Presumably this is as a result of an EU directive. Which UK law enacts this directive?

  • 1
    This appears to be a question about laws themselves, not about the politics and political processes which create them. This makes this question more appropriate for Law Stack Exchange than Politics Stack Exchange. – Philipp Nov 12 '18 at 12:25
  • 2
    @DVK We had these "this site uses cookies" warning before the GDPR. The GDPR just extended it. – Philipp Nov 12 '18 at 13:06
5

As SJuan76 mentions in a comment, the first cookie-related EU law was:

Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws

This being an EU Directive, it required transcription into UK law to be valid in the UK. This was effected by:

The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011

This is a statutory instrument made under the European Communities Act 1972, and came into force on 26 May 2011.

2

It is not a directive, it is a regulation

More specifically, it is the General Data Protection Regulation, or GDPR; we even have a tag for it.

Now to the core of the question, GDPR being a regulation and not a directive means that it enters into effect without need of national Parliaments to adapt their laws to enact it. Or, as the GDPR FAQ page explains

What is the difference between a regulation and a directive?

A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the the previous legislation, which is a directive.

In any case, some aspects of the GDPR1 are left to the national Parliaments to decide. In the UK there is the Data Protection Act of 2018


1For example definition of what is the age limit for "minors" or if permission is enough to process highly sensitive data like health data.

  • 1
    Thank you. The “cookie law” was in effect well before GDPR. Does this mean GDPR incorporated, superseded or extended it? – Ben Nov 12 '18 at 13:19
  • GDPR incorporates many provisions that affect cookies, as those can be used to gather personal data (e.g. if a cookie tracks which pages you visit in order to sell publicity then GDPR stipulates that consent is needed), but does not focus on them. It does not supersede or extend the cookie law (i.e. it is not derived from it) but it forces additional constraints. – SJuan76 Nov 12 '18 at 13:46
  • Thank you. Do you know what regulation or directive imposed the original cookie law? – Ben Nov 12 '18 at 13:52
  • 2
    AFAIK it would be the 2009/136/CE directive, which ammended directives 2002/22/EC, 2002/58/EC and regulation No 2006/2004. It seems that one issue is that it asked for "consent" but it not required it to be "explicit" (i.e. it could be argued that as long as there was a way of rejecting the cookies and the user did not use it there was consent), This is one of the reasons why the GDPR (that in no uncertain terms requires explicit consent) has led to all those dialogs. – SJuan76 Nov 12 '18 at 14:04
2

SJuan76's comment from a different angle:

GDPR incorporates many provisions that affect cookies, as those can be used to gather personal data (e.g. if a cookie tracks which pages you visit in order to sell publicity then GDPR stipulates that consent is needed), but does not focus on them. It does not supersede or extend the cookie law (i.e. it is not derived from it) but it forces additional constraints. – SJuan76 3 hours ago

Basically, the Cookie Directive and GDPR operate on 2 different levels, which might overlap: we can say that GDPR applies only as long as the cookie is collecting data considered "personal" or "online identifiers" by the Regulation. If it happens, then the consent window (you called it "dialogs warning") has to be more strict, as per GDPR requirement (I am just mentioning one of the effects). Otherwise, the less-strict Directive will apply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.