Cookie Conundrum? Article 5(3) of the EU ePrivacy Directive
•Download as PPT, PDF•
1 like•835 views
Slideshow for presentations at the Cookie Compliance Conference, 6 December 2011, London and the Roundtable Medienpolitik, 7 December 2011, Brussels
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cookie Conundrum? Article 5(3) of the EU ePrivacy Directive
Similar to Cookie Conundrum? Article 5(3) of the EU ePrivacy Directive (20)
More from Carl-Christian Buhr
More from Carl-Christian Buhr (20)
Recently uploaded
Recently uploaded (8)
Cookie Conundrum? Article 5(3) of the EU ePrivacy Directive
- 1. Cookie Compliance Conference, 6 December 2011, London and Roundtable Medienpolitik, 7 December 2011, Brussels Cookie Conundrum? Article 5(3) of the EU ePrivacy Directive Carl-Christian Buhr European Commission (All expressed views are those of the speaker.) http://slidesha.re/cookieeu http://bit.ly/cc_buhr , @ccbuhr
- 2. http://bit.ly/NeelieKroesEU , @NeelieKroesEU http://ec.europa.eu/digital-agenda DAE 101 Actions
- 3. http://bit.ly/NeelieKroesEU , @NeelieKroesEU http://ec.europa.eu/digital-agenda 101 Actions Advising on... ePrivacy/Data Protection Cloud Computing ICT Standardisation Research Policy etc. http://bit.ly/cc_buhr , @ccbuhr
- 4. The ePrivacy Directive “ Directive (2002/58/EC) on privacy and electronic communications as amended by Directive 2009/136/EC ("Citizens' Rights Directive")” [ Link ] ⟹ Adopted by EU Parliament, Council 2009 ⟹ Transposition deadline for Member States 25 May 2011, delays in several Member States
- 5. Article 5(3) From right to refuse to consent “ Member States shall ensure that the storing of information , or the gaining of access to information already stored , in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent , having been provided with clear and comprehensive information , in accordance with Directive 95/46/EC, inter alia about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service .”
- 6. Article 5(3) basics ⟹ Not limited to cookies ⟹ Not limited to specific uses ⟹ Not limited to telcos ⟹ Obliging providers ⟹ Technologically neutral
- 7. The Status Quo is not enough Online privacy – reinforcing trust and confidence , Brussels, 22/06/2011, http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/11/461 “ This revision of the ePrivacy Directive has brought a material strengthening of protection for citizens and Member States need to make sure this is reflected in national law.”
- 8. Article 5(3) in Member States Commission guidance paper ⟹ Commission services working document of 20/10/2010 ⟹ Presented to Communications Committee of Member State representatives ⟹ Aim: Help prevent fragmentation
- 9. Tracking is the issue Online privacy – reinforcing trust and confidence , Brussels, 22/06/2011, http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/11/461 “ [O]nce user profiles exist they can potentially be used for all kinds of things . “ [D]ifference between a commitment not to record tracks and a commitment not to use them for a specific purpose once recorded”
- 10. EASA/IAB OBA Self-Regulation http://www.easa-alliance.org/page.aspx/386 “ What I like about this solution is that it is active . Industry is not just saying – as some unfortunately still do – that all is fine because users can disable cookies in their web browsers.” [ link ] ⟹ Assuring compliance on its own: doubts ⟹ Scope: limited to certain methods, uses
- 11. Need broader discussion “Do not track” (DNT) Online privacy – reinforcing trust and confidence , Brussels, 22/06/2011, http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/11/461 DNT can apply to all devices, types and purposes of tracking “ We need a standard!” Deadline: June 2012 W3C has started work
- 12. DNT Scenario after June 2012 Online privacy – reinforcing trust and confidence , Brussels, 22/06/2011, http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/11/461 1. Simple Message : If you do DNT you are fine! 2. Virtuous Circle of adoption by users and providers 3. Enabled by tool makers' innovation on sufficiently rich standard
- 13. Browser settings etc. 1. ePrivacy obliges provider, not browser 2. DNT lets provider know user preference! ⟹ Good chance for future browser settings to become sufficient ⟹ Issue: How to deal with unset DNT (trigger user prompt? rely on earlier browser prompt? etc.)