The UK Department for Business, Innovation and Skills (BIS) has just published a public consultation on the implementation of the revised EU Telecoms Package.
The Telecoms Package, a set of five directives that regulate the electronic communications sector in the European Union, contains the so-called e-Privacy Directive. As part of the review, the existing opt-out rule for the use of browser cookies, which are widely used to deliver targeted marketing messages on the internet, was replaced by a requirement to collect the consumers' "consent". This ambiguous wording leaves it up to national governments to clarify whether they interpret "consent" to mean "prior opt-in consent", or whether they prefer to stick with the existing "implicit opt-out consent" rule.
BIS proposes to implement the relevant parts of the Directive by copying the exact wording into the new, national law - without clarifying whether "consent" is to be interpreted as an opt-in or opt-out approach. In practice, this would mean that the exact meaning of "consent" is to be interpreted by the data protection regulator, the UK Information Commissioner's Office (ICO).
According to Outlaw.com, BIS recognises the importance of cookies (AKA targeting) to make the Internet work and deliver value to users:
"The internet as we know it today would be impossible without the use of […] cookies," says BIS. "Many of the most popular websites and services would be unusable or severely restricted and so it is important that this provision is not implemented in a way which would damage the experience of UK Internet users or place a burden on UK and EU companies that use the web."
"The Directive acknowledges this by saying that consent is not required when the cookie is strictly necessary to deliver a service which has been explicitly requested by the user," it says.
BIS goes on to say that since the range of uses where a cookie is strictly necessary to deliver a service online are impossible to define due to the fast moving nature of the Internet, and therefore it will be down to the Information Commissioner's Office (ICO) to interpret the Directive in practise.
The risk, and likely outcome of this tactic, is that any degree of certainty around the use of 3rd party cookies for online targeted advertising, or online behavioural advertising, gets kicked into the long grass until next spring 2011 by which time the ICO will be forced one way or another to declare its hand.
In the meantime, we await the moment that some EU member states will no doubt feel compelled to be more forthcoming - and give their view on what constitutes personal data; the weight they will give to Recital 66 (non binding guidance that suggests browser settings could constitute an affirmative consent mechanism), and illuminating examples of application areas that are to be construed to need cookies to deliver a service.
Imagine a scenario where every member state interprets the e-Privacy Directive differently. Now combine that with a further scenario which obliges business to apply country of destination laws to their online activities (instead of country of origin laws) and you end up in with an almightly mess. This, I'm afraid to say, is exactly the scenario we are about to face in reality.
That's why it's important to participate in BIS's Consultation, specifically responding to the impact assessment questions.
BIS Consultation is open until December 3rd. You can respond with your point of view and any evidence via this link or directly online via BIS's Survey Monkey. Don't just listen to the debate, submit your view to the UK Government and help legislators understand the impact of a literal implementation of the ePrivacy Directive.