How the new EU cookie law affects law firms

'Great article and lots of good info. I challenge the legality of such laws as how are you to ascertain when a company is based in the EU or not? Corporates like Coca-Cola are global brands and have audiences on many continents, so it begs the question about enforceability.

I personally don't see this as ever being enforceable and will certainly have a negative impact on all web traffic as a result. This goes against the grain of new technologies and forces the general public to engage in exercises of authentication and opting-in, rather than the web 3.0 approach to content curation. Think how this might impact Google searches?

I studied Law at University and the incompatibility with most EU laws in the UK means that individual member states will do whatever they want, when they want. EU Law is a waste of time in my opinion and adds little value to our society in the UK.

ABBII

Hi Rory,

Traditionally, law, finance, and ANYTHING to do with public sector are very slow on the uptake of most web-related trends and issues; especially, social media. What I do find quite often is that is not because they don't want to, but because they lack the necessary in-house skills to manage.

Being savvy is a great way to reference what I call apathy and lack of understanding. I am not really sure that most companies and business leaders outside of IT even understand what a cookie is in the first place. There will always be those that comply before the ink has dried on new legislation, but then there are others that simply don't care, know, or understand. This will be the litmus test for me...who will actually spend the time, money, and other related resources to comply in an area that most laws can't even govern as we speak.

Take my blog dated Aril 30th. I have been harassed, stalked, and generally annoyed for over 18 months. Legally I have some grounds for action, but is it worth the time, effort, and resources to fight? I think not. Until our government gets their heads around everything to do with the web, I don't think the EU has a chance.

Article 8 of the ECHR is the most abused article in the history of mankind. I am sure that blurred geographical boundaries, time zones, and technology will find a loop hole for non-compliance. I'll be intrigued to see what happens. Where will the EU start with enforcement? That will be even better. I bet it won't be in Brussell's though!

Wales is the lowest ranking region in the UK, for Internet access and usage, so the enforcers can stay on your side of the bridge for a while.

ABBII

Report abuse reply

Thanks for the interesting article.

I do however, take small issue with the slightly specious remark, "No need to ask what all the website developers will recommend."

While there is no doubt opportunity to 'cash in' on this (and some will for sure), I for one, see it as an incredible pain in the rear, for both my clients and our industry in general.

There are MUCH better ways of making money than fiddling around dozens of client's websites to make them compliant with this asinine law. And in addition, dealing with the surge of emails, phone calls etc. from panicked website clients, who may well think it is our responsibility to make the problem 'go away' simply because we built their website.

I will, of course, do my best to assist website owners deal with this new requirement but please don't think I'm rubbing my hands together in glee over this. At all.

Cheers,
David

I agree with you Rory that most law firms will take a wait & see approach. Or maybe that is because most law firms won't even know about the issue...

We recently had our site redesigned and decided simply to add a paragraph to the privacy policy (which I'm sure everyone always reads!) On another solicitors' site I saw, they had a massive banner about cookies and a button to click that you accepted, but the website worked fine whether you accepted or not.

If only we could be more like the French: agree to the laws in a meeting and then do our own thing afterwards!

We tend to be the ones who are first in line for complying, and also the ones who are finding it the most difficult with the least resources.

There are lots of networking groups with some very stressed and worried small business owners having discussions and arguments (mostly stress driven) about what we need to do.

I took the approach of having a photo of a plate of cookies on my home page with 'Want cookies?' and a link. This goes to a page with a humorous photograph and details of what cookies my site may have, and what it won't, and what they are used for. I've used a lot of humour and a lot of talk of chocolate, superheroes and wanting to be sent nice things by marketing people in my explanations.

I'd appreciate a legal perspective on my rather unusual approach -
How I complied with the EU Cookie Law, my style - http://bit.ly/KnrTuH

Moving towards compliance is enough for now. Enforcing websites to have intrusive pop-ups with opt-in or opt-out options (which, by the way, rely on cookies to work) is unrealistic. In my opinion, a decent page like Gregg Latchams is enough for now, although they, like all of us should probably list the cookies that their site uses. That is a pretty transparent way of going about things without all this opt-in ridiculousness.

In my previous comment I said "I would suggest (but not advise of course) that businesses take a risk-based approach - the more intrusive the cookies stored on a user's computer (i.e. targeting cookies), the more important it is to comply by 26 May."

That being said, I think the ICO's view will be that we have all had a year's grace to comply with the new Regs! I doubt that the ICO, in the cases it pursues, will have much time for defences such as "We didn't have enough time", "This law sucks", "We have no resources to pander to the protectionist whims of the EU"...

Re Paul's comment, I am currently building two websites and using the WordPress EU cookies plugin (http://wordpress.org/extend/plugins/eu-cookies-plugin/) which works really well.

More helpful comments from everyone, thank you.

My provocative remark about web developers helped to get the conversation going, but maybe I should have aimed it at the lawyers instead, to get them champing at the bit re this discussion.

Happily, we have so far managed to avoid the usual band of self-publicists who invade so many online conversations with their non-comments ... and we have avoided the barbed comments of the many anonymous commenters who seem to thrive on this site.

But let's now open the conversation up a bit. We'll do a few tweets with the #CookieLaw hashtag to broaden out the audience and we'll see if it brings in any more angles on this debate.

(Completely changing the subject for a moment, did anyone notice John Hyde's news blog 'Twitter Twits' on this website on 11 May, lamenting the fact that so few UK lawyers have bothered to look into, and get an understanding of, the commercial benefits of Twitter? Someone said to me the other day that lawyers were the last people in the UK to use business cards, they were one of the last to use email ("What's wrong with the post?"), and so from the outset one could safely predict that they will be one of the last to understand social media. Interesting comparisons, I'd not heard the business card 'fact'(?) before.)

Here’s an update (Thursday afternoon, 24 May).

Not much has happened since the ICO press briefing last week (see the econsultancy.com website for details), when the ICO deputy commissioner David Smith said that the ICO’s first step in enforcing the new law will be to contact 50 key UK websites to ask them what their position is on compliance.

As regards the website of a typical business, he confirmed that if such a website was not yet compliant the ICO would only impose a fine if extreme criteria were met: “It would have to be a serious breach and it has to be likely to cause substantial damage or distress to individuals.”

This afternoon, a quick check shows that more websites have gone live with their compliance solutions (eg the FT), while others are using more heavyweight policies (eg BBC, John Lewis). But most websites remain blissfully unaware of this new law, and have little to fear from it, as already discussed.

There are now lots of instant compliance options being offered by developers. Just put the hashtag #cookielaw into Twitter and you can find them easily. That’s the beauty of Twitter compared to Google, it really is instant, whereas climbing the Google rankings can take years.

I have just noticed this item in Charles Christian's 'The Orange Rag' legal IT blog (25th May):

COOKIE LAW IN 11th HOUR 'IMPLIED CONSENT' CHANGE

The Information Commissioner’s Office (ICO) has issued updated its Guidance on the rules on use of cookies and similar technologies just one day before it is due to begin enforcing the rules on 26 May 2012. The main change from the previous version published in December 2011 is a new and much expanded section on ‘implied consent’.

Stephen Groom, Head of Marketing and Privacy Law at law firm Osborne Clarke, said: “Previously ICO said that implied consent would be unlikely to work, now it says that implied consent is a valid form of consent.This is a striking shift in how ICO says it will tackle compliance. Just six months ago it said general awareness of the functions and use of cookies was simply not high enough for websites to look to rely entirely in the first instance on implied consent.

“Now it tells us that ‘implied consent has always been a reasonable proposition in the context of data protection law’ and that it remains so in the context of storage of information or access to information using cookies and similar devices. Although this new, pragmatic approach is undoubtedly more business-friendly, ideally it would have been good to have had earlier visibility of this dramatic change. It also remains to be seen whether this puts the UK out of step with Brussels and most other EU states.”

This is taken from a 29 May article by Zack Whittaker on ZDnet.com:

SWEET IRONY: E.U. IMPOSES COOKIE LAW, IGNORES OWN RULES

You would think an executive body of 27 member states that dictates part of their respective laws would adhere to its own? Think again.

On all European Union institution websites, you will be lucky to find a single page that asks the visitor for permission to set cookies. But they’re using them all the same...

The Article 29 Working Party — the group which advises individual European privacy authorities on matters of data protection, and the European Data Protection Supervisor — a cross-nation group of data protection officials, both fail to adhere to the E.U.-wide so-called “cookie law”.

Despite the U.K. “cookie law” taking effect over the weekend, wider E.U. institutions — including the European Parliament and the European Commission — are not practicing what they preach.