The Data Protection Working Party recently announced its vision on how and when permission needs to be obtained for placing and reading cookies. Thuiswinkel.org feels that the working group’s interpretation of the e-Privacy Directive is incorrect. Due to an incorrect appraisal of everyday practice, the requirements they stipulate for obtaining permission are too strict. Thuiswinkel.org contests its interpretation.
On 2 October 2013 the Art. 29 Data Protection Working Party – which is comprised of all national privacy authorities – issued a guidance on how and when permission needs to be obtained for placing and reading cookies. In short the guidelines stipulates that permission to place or read cookies must be:
- based on specific information given in advance;
- obtained before cookies are placed or read, and thus before the processing starts;
- apparent from a positive act or other active behaviour of the consumer;
- given freely, based on a real free choice.
Art. 29 Working Party has interpreted the directive wrongly
Thuiswinkel.org feels that the Working Party has interpreted the e-Privacy Directive incorrectly and, based on that incorrect interpretation and incorrect representation of actual webshop practice, stipulates requirements for obtaining permission that are too strict. Thuiswinkel.org contests this interpretation:
1. The demand that consent for placing or reading cookies needs to be unambiguous is incorrect. The e-Privacy Directive refers to the Data Protection Directive in relation to consent. This defines (article 2, under h) consent as “any freely given specific and informed indication of his wishes by which” the person concerned agrees that cookies are placed or read. It does not stipulate that the permission must be unambiguous.
2. The requirement that permission must be apparent from a positive act or some other active behaviour (at least an opt-in) is also incorrect and is not evident in the Data Protection Directive or the e-Privacy Directive. Article 2, under h only requires an indication of the person’s wishes, indicating that he or she agrees to cookies being placed or read. Legal doctrine generally accepts that an indication of a person’s wishes can be based on all behaviour of the data subject, which includes – dependant on the context and circumstances inactivity like doing or saying nothing. In this commonly accepted interpretation, the requirement of an active or positive action is not stipulated by article 2 of the Data Protection Directive
3. Furthermore, the Working Party recommends – wrongfully – that, based on the principle of free choice, access to the websites of e-commerce businesses may not in general be made dependent upon consent for placing or reading cookies (a cookie wall). This shows that the Working Party’s perspective on e-commerce is unrealistic. No serious business would deny consumers access to his website – read: refuse to sell a service or product! – if the customer does not accept the placing or reading of cookies. The fear that businesses will do this is, in fact, an unfounded, biased expression of the mistrustful attitude of the working group towards the e-commerce sector.