The European Directives and resulting UK legislation, designed to protect users’ personal data as they move about the web, has turned out to be more than a clampdown on cookies. It’s about cleaning up the internet so that customers don’t need to worry about who’s watching them, and brands don’t need to worry about betraying their trust. So why all the resentment, asks Mark Jones, Head of Compliance at Celebrus Technologies.
The clampdown on personal data collection via the web can only be a good thing for internet-based businesses, rebuilding consumers’ confidence in what they do online. Judging by the resentment being exhibited across the industry towards the regulations however, it may take time for many companies to realize this.
Technically, from the point at which the UK’s new statutory regulations came into force on May 26th this year, any website that stores data about a visiting user on their computers, without having gained informed consent in advance, will be doing so illegally.
Many have objected to the depth to which the new rules go. Indeed, the ICO has placed the onus firmly on the company to gain each user’s permission before being allowed to store or read any information on their device.
The Government’s decision to “defer enforcement” for a year allows for a more realistic timeframe, and demonstrates how the significance of the implications of the legislation has been recognized. It also extends the opportunity for enhancements in browser technology to address the cookie consent issue – but this may not provide a complete solution. Couple this to the fact that the implementation of the EU Directives will vary by country, and most online retailers operate in an international environment, and website owners are left with the inescapable conclusion that “sitting and waiting” is not an option.
Informed consent
Companies are now banned from storing or retrieving information on the user’s PC or mobile without the user’s “prior, informed consent” for any purpose that is not “strictly necessary for the provision of the service requested”. And the rules are strict: any use beyond simple “basket remembering” types of use will require consent, meaning that the user must agree to the data being stored and confirm that they agree to the way in which their data will be analyzed.
While there will be a grace period, the potential penalties for non-compliance are significant. Provision has been made for fines of up to £500,000, while the negative PR associated with flouting the rules could put companies out of business.
The severity of the measures has come as a shock to the industry, which is reeling from the additional demands that now fall to web owners and managers. Bemoaning the clampdown however, will only create a lot of hot air. Ultimately, the brands have no choice but to absorb and respond to the new requirements. A better approach would be to see the positive in the situation.
Showdown time
The trigger for the legalization has been the realization of just how open users’ proffered information has become. Currently, a whole host of personal data is being collected without users’ knowledge, which is sinister at best. Few could therefore argue against the need for a clean-up, for the introduction of greater controls and better protection for web users.
Some have wrongly assumed that the new legislation is a crackdown on cookies, but it is not. It is not only more comprehensive than that but it also allows for the use of cookies in circumstances where this is felt to add value. For example, cookies can be used to help companies remember whether permission has or has not been given, so that this does not have to be repeated.
Embracing positive change
Hindsight is a wonderful thing, and it won’t be long before the current change in legislation seems logical, if not long overdue. The benefits will be a cleaner industry for all, and greater buy-in from customers as improved transparency helps to restore their confidence in doing business online. However the industry feels about the new restrictions, the positive benefits will far outweigh any inconvenience involved in making a few adjustments to existing web activities.
By Mark Jones
Head of Compliance
Celebrus Technologies
