ICO urges public sector to prepare for change in law on use of cookies

The Information Commissioner has urged the public sector as well as private businesses to prepare for a new law coming into force in two months time requiring them to obtain consent from visitors to their websites to the use of cookies.

This requirement to obtain consent in order to store on and retrieve usage information from users’ computers follows an amendment to the Privacy and Electronic Communications Directive. It will come into effect on 25 May 2011.

One of the most common techniques for this is the use of cookies, small files that a website puts on the user’s computer so that it can remember something later, for example their preferences. Cookies are used in a range of ways, such as analysing browsing habits and remembering payment details.

Speaking at the ICO’s annual data protection officer conference this week, Christopher Graham said: “While the roll out of this new law will be a challenge, it will have positive benefits as it will give people more choice and control over what information businesses and other organisations can store on and access from consumers’ own computers.

“The Directive will come into force in less than two months time and businesses and organisations running websites in the UK must wake up to the fact that this is happening. We are proactively working with the government, businesses and the public sector to find a workable solution.”

Graham said the ICO, which will be responsible for regulating the new regime, recognised that the internet depended on the widespread use of cookies and there were legitimate business reasons for using them.

“So we are clear that these changes must not have a detrimental impact on consumers nor cause an unnecessary burden on UK businesses,” he insisted, adding that one option under consideration was to allow consent to the use of cookies to be given via browser settings.

“Once the new regulations are published there will be a major job of education and guidance to be undertaken. In the meantime, both the business community and public sector organisations need to start thinking clearly about how they will meet the requirements of the new Directive.”

The Department for Culture, Media and Sport is leading on implementing the new measures in the UK. Culture Minister Ed Vaizey said: “Revisions to the e-Privacy Directive will provide consumers with more choice and control over their internet experience. But at the same time we need to make sure these changes do not make using the internet more difficult.

“Businesses need to be working to address the way they use cookies. We recognise that work will not be complete by the implementation deadline. The government is clear that it will take time for meaningful solutions to be developed, evaluated and rolled out.”

Vaizey added that because of the potential uncertainty for businesses and consumers, the government would not expect the ICO to take enforcement action in the short term against businesses and organisations as they work out how to address their use of cookies.