Article 29 Working Party Opinion 2/2010 on Online Behavioural Advertising: Who Wants Cookies?
 |
Introduction
On June 22, 2010, the influential Article 29 Working Party ("Working Party"), consisting of all the European Union's national data privacy regulators, adopted Opinion 2/2010 on online behavioural advertising (the "Opinion").
The Legal Framework
Article 5(3) of the ePrivacy Directive was amended last year to provide as follows:
Member States are required to implement the provisions of the ePrivacy Directive in national law by May 2011 at the latest, so the clock is ticking while a technical and practical solution is sought.
In addition to the ePrivacy Directive, the European Data Protection Directive 95/46/EC (the "Data Protection Directive") also applies to the processing of personal data. As most online behavioural advertising will result in the creation of detailed user profiles, it is almost inevitable that the vast majority of uses will require compliance with the host of obligations and principles arising from the Data Protection Directive.
Who is affected by the ePrivacy Directive?
The Working Party identifies three main players in behavioural advertising activity that will be affected:
In practice, there will be a significant degree of overlap with these roles, and many clients could well be affected by the new legal framework because they fall within more than one category. What Activity is Within the Scope of the ePrivacy Directive?
The focus of the Working Party's concern is, broadly, "tracking and advertising technologies used to deliver behavioural advertising" – activity that is mainly done by using "tracking cookies" of various types. Whilst acknowledging the key role and importance of online advertising in terms of the growth and expansion of the Internet economy, the Opinion advocates significant restrictions on such activity and technology in the future.
In the view of the Working Party, the current practice of those engaged in behavioural advertising – the placement of cookies upon accessing a website that is part of the ad network unless the user's browser is set to reject cookies, combined with the provision of information about cookies used for behavioural advertising in general terms and conditions and/or privacy policies – does not meet the requirements of Article 5(3), which emphasises the need to provide information and obtain consent before the start of any processing.
What Consent is Required?
The level of consent necessary to be valid under both Directives is the same. It is based on the requirements of the Data Protection Directive. Consent to placing cookies or similar tracking technologies on users' computers or other devices must be:
The Opinion makes it clear that in the view of the Working Party, "browser settings may only deliver consent in very limited circumstances." In effect, these would be where:
Unfortunately, these circumstances bear little or no relation to reality for the vast majority of users. How Can Such Consent be Achieved?
On the face of it, the Opinion presents significant obstacles to, and disruption of, the user experience of the Internet if the law requires users to opt-in to every cookie put on to their computer. One of the few concessions to practicality that does appear to be acknowledged by the Working Party is the recognition of a need for some kind of single acceptance of cookies and what they do. This could amount to user consent both to receive a cookie in the first place, and also for that cookie then to be used subsequently to monitor the user's Internet browsing.
Delivering a solution that meets these safeguards without impeding the online interaction between advertisers and users presents further practical compliance challenges to the industry. These challenges require the input of those responsible for designing and developing browser technology to come up with "privacy by design" solutions to address the problem. Challenges for the Industry The Opinion challenges the digital advertising industry to provide "a simple explanation on the uses of the cookie to create profiles in order to serve targeted advertising," which has to be "clear and comprehensive" and provided in a way that is "as user friendly as possible." The Working Party is not prescriptive about how this is achieved, and appears to be open to proposals from the industry and other key players as to possible solutions, encouraging providers, advertisers and publishers to "spare no effort...to...ensure the maximum level of awareness among internet users as to how behavioural advertising works." To this end, the Working Party has called upon industry "to put forward technical and other means to comply with the framework...and to exchange views with [them] regarding such means." Directive 95/46/EC and Wider Compliance Obligations
Aside from the very specific challenges presented by the ePrivacy Directive, the Opinion makes it clear that all the obligations of the Data Protection Directive are likely to require consideration when publishers, advertisers and providers engage in behavioural advertising and related personal data-processing in any EU Member State. The range of additional considerations includes:
Final Thoughts If the Working Party's Opinion holds sway with the Commission and national law-makers responsible for implementing the ePrivacy Directive, then the digital advertising industry will be required to review and completely overhaul existing technology and practice in the area of behavioural advertising in order to achieve the level of informed consent from users that the Working Party says the law requires.
We await more details of how the ePrivacy Directive, and Article 5(3) in particular, is going to be implemented at the national level. We also note that the approach of the European Commission to implementation of the ePrivacy Directive may accommodate more of a role for self-regulation. In the meantime, those operating in the industry and affected by the proposed new law are encouraged to make their views known both to the Working Party and the Commission.
If you have any questions, or would like additional information on the material covered by this Alert, please contact:
|  |
