Episode 5: Cookies and the GDPR – ICO v CNIL

GDPR Now!

Karen Heaton/Data Protection 4 Business

Gdpr Now!, Data Breaches, Cyber Security, Personal Data, Gdpr Now, Outsourced Dpo, Management, Business, Data Protection Officer, Business News, Privacy, It Security, Data Protection, News, Gdpr

4.8 • 11 Ratings

🗓️ 5 August 2019

⏱️ 31 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

GDPR Now! is brought to you by This is DPO, www,thisisdpo.co.uk. *Cookies and the GDPR– ICO v CNIL. * About this episode: Both the UK’s ICO and France’s CNIL have issued updated guidance on cookies. You would have thought that this is all old stuff, but the ICO’s paper comes hot on its Adtech paper where it stated that the UK industry does not understand the rules around cookies, nor the interrelationship between cookies and the GDPR. In this podcast, we take a look at the eprivacy directive and see to what extent it makes sense and can be reconciled with the GDPR. There are some surprises as it turns out that the CNIL has invented a new legal type of cookie. This podcast is essential listening for anyone who wants to use cookies, whether first party or third party. Host: Mark Sherwood-Edwards of This Is DPO. www.thisisdpo.co.uk Email: [email protected] Telephone: 07748 761972 Material referred to: Here’s the important paragraph from the ICO’s Guidance on the use of cookies and similar technologies (bottom of page 46): The ICO cannot exclude the possibility of formal action in any area. However, it is unlikely that priority for any formal action would be given to uses of cookies where there is a low level of intrusiveness and low risk of harm to individuals. The ICO will consider whether you can demonstrate that you have done everything you can to clearly inform users about the cookies in question and to provide them with clear details of how to make choices. For example, the ICO is unlikely to prioritise first party cookies used for analytics purposes where these have a low privacy risk, or those that merely support the accessibility of sites and services, for regulatory action. Guidance on the use of cookies and similar technologies, ICO https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/ Délibération n° 2019-093 du 4 juillet 2019 portant adoption de lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture et écriture dans le terminal d'un utilisateur (notamment aux cookies et autres traceurs), CNIL https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038778053&dateTexte=&categorieLien=id Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities, adopted on 12 March 2019, EDPB. https://edpb.europa.eu/sites/edpb/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en_0.pdf Contact details You can contact the show at [email protected]. If you have questions, comments, suggestions for topics, or would like to appear on the show, please contact us on the email above.

Transcript

Click on a timestamp to play from that location

0:00.0	Welcome. This is GDPL Now and this week we are talking about cookies. Why cookies? Because in July,
0:08.1	two regulators came out with papers on that subject, the UK ICO and the French canil.
0:16.8	Now, you may think that there's not much in cookies, but actually both those papers have got quite a lot of interesting material.
0:24.4	In fact, far more than meets the eye.
0:26.9	We're going to spend the next 30 to 40 minutes.
0:29.4	30 minutes in theory, 40 minutes or more if we run talking about cookies.
0:34.6	Just to remind you that this podcast is brought to you by This is DPO. And your host this
0:40.5	week is Mark Sherwood Edwards. So that's me. Normally I'm joined by other people. Just this week,
0:47.0	I'm not. Just to me on my own. So hold on to your hats. Now, before we actually launch into the podcast proper, just some terminology,
1:00.2	for those who are not familiar with data protection in the UK,
1:03.9	the e-privacy directive was implemented by the Privacy and Electronic Communications Directive, known in the UK by the uplifting acronym of Pecker.
1:15.5	So every time I say Pecker in this podcast, that's what I'm referring to.
1:20.1	The E-Privacy Directive also talks about users and subscribers.
1:24.2	I'm just going to talk about users.
1:25.8	There's not much difference between the two.
1:35.3	And when I say cookies, I mean any kind of tracing technology, whether it's a cookie or a pixel or a tag or any other form, including fingerprinting, where the recognition happens
1:42.3	on the server side and they're just recognizing your device.
1:46.6	Okay, so if you're sitting comfortably, let's begin.
1:52.4	So the ICO's report is called Guidance on Use of Cookies and Similar Technologies.
1:58.2	It came out the first week of July, it's about 50 pages long.
2:01.6	And what the ICO does, it sets out the three types of cookies set out in the directive.
2:08.6	And the three types are the communication cookie, I'm not going to talk about that much.
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from Karen Heaton/Data Protection 4 Business, and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of Karen Heaton/Data Protection 4 Business and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.