Today the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 come into force, implementing the revised EU ePrivacy Directive in the UK.
What has changed?
- Websites must now obtain consent before storing or accessing cookies and similar technologies on a user’s device, unless they are strictly necessary for a service the user has requested.
- Users must be given clear and comprehensive information about what cookies are used and why.
- Public electronic communications service providers must notify the ICO of personal data breaches.
The ICO has announced a 12-month grace period for website owners to bring their sites into line, but expects organisations to start work now.
What should you do? Carry out a cookie audit of your websites, categorise each cookie by purpose and intrusiveness, update your privacy and cookie notices, and decide how you will obtain meaningful consent.
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
