New guidance from the ICO about the cookies regulations

In my last blog (Website owners are warned by Information Commissioner) I mentioned that the ICO had issued updated guidance on compliance with the new cookies regulations introduced last year. This new version of the guidance is much more detailed than the original version and, along with the report from the Information Commissioner which I talked about previously, also warns that, if your website uses cookies or similar technology for storing information, you should not simply ignore the regulations as they are here to stay.

The updated guidance is more comprehensive as it brings much relevant information together in one document after the rather piecemeal publications at the time the regulations came out. It includes a summary of the relevant law and terminology used before going into more detail as to what website owners should do now and in the longer term to work towards compliance if they have not already done so.

The basic message is that website owners need to tell visitors what cookies their site uses, explain what those cookies do and obtain consent for any that are stored on the visitors’ computer, mobile phone or other web-enabled device. This message is emphasised throughout by key points which are repeated a number of times along the lines of the need to provide clear and comprehensive information and mechanisms for making choices, all of which should be as readily available and easily accessible as possible. Any website owner who decides to rely on the exceptions to the requirement to obtain consent should check carefully the advice on the exceptions as the ICO’s view is that these are limited and will be interpreted narrowly.

What is welcome, in view of the clear indication that the regulations are here to stay and that they will be enforced, is the considerably expanded section containing practical advice on how to comply for those requiring it. Some of the suggestions may be less welcome and will no doubt be viewed by some as impractical or entailing effort and cost that they would prefer not to incur, but website owners whose sites use cookies will have to take some action. The original guidance seemed to give some hope that technical improvements to browser settings might provide a means for many websites to demonstrate that visitors had set their preferences as regards the use of cookies. The updated version now says that, whilst the government is still working with the major browser providers, there is no solution yet available and, even when such solution is available, it will take time for it to be used, so in the meantime websites should use other means of complying.

The details of the ICO’s enforcement powers and possible penalties for failure to comply were issued a short while after the original regulations and after the twelve month lead in period was announced, so may have gone largely unnoticed at the time. The enforcement powers and penalties are now included in the new version of the guidance so cannot be overlooked. What is useful is the indication of the practical and proportionate approach that will be applied to enforcement with the more formal action and higher monetary penalties likely to be reserved for what are viewed as the most serious breaches as prioritised by the ICO.

The clock is running – the twelve month period allowed by the ICO to comply before they start enforcing the new law runs out on 26th May 2012. If your website uses cookies I would strongly recommend that you start preparing now. The ICO’s new guidance is a good source of reference and contact me if you would like any assistance.

Sue Mann
Commercial Solicitor, Birmingham

Tel: 0845 003 5639

Previous blogs on this topic which you may wish to look at are: 

New rules on the use of cookies 

Time to comply with the new rules on the use of cookies 

Website owners are warned by Information Commissioner about lack of progress in compliance