On 6 April, the Data Protection Commission of Ireland (DPC) released a substantive Guidance Note on cookies (Guidance) and provided organizations a grace period of six months to ensure compliance. After the end of the six-month window, which is 5 October 2020, the Irish DPC may act to enforce the Guidance and can hold organizations liable for failing to obtain valid consent before the processing of cookies.
This Guidance was issued based on the report released by the DPC on the findings of a “cookie sweep survey”. The survey was conducted on around 38 organizations operating within the territory of Ireland and around 35 of those companies were found to be significantly lacking in cookie compliance requirements. The DPC noticed the following non-compliance practices of organizations, among others:
- Dropping of non-essential cookies on landing pages without obtaining user’s consent,
- The lifespans of most cookies that are dropped are not proportionate to the purposes of the cookies,
- Inadequate cookie banners,
- Frequent use of pre-checked boxes for the processing of non-essential cookies,
- A lack of stand-alone cookie policies,
- Failure to fulfill the requirements of a valid consent as per the General Data Protection Regulation (GDPR) and the Irish e-Privacy Regulations.
Based on its identification of the above non-compliance areas, the Irish DPC released the comprehensive Guidance for organizations. The Guidance explains the purposes of cookies as well as it adheres to the requirements of the GDPR, e-Privacy Directive, and the Guidelines on Consent of the European Data Protection Board, released on 4 May 2020 that declared cookie walls invalid.
Read EDPB’s Updated Guidelines on Consent
The Guidance also complements the landmark decision by the Court of Justice of the European Union in the Planet49 case that declared the use of pre-checked boxes as an invalid mechanism of obtaining users’ consent.
Key Points:
Some of the key points of the DPC Guidance are set out below:
Valid consent
Data controllers must obtain valid consent of users before the processing of cookies except the processing of strictly necessary cookies and communication cookies, i.e. cookies that are processed for carrying out the transmission of a communication over a network. A user’s consent must be freely given, specific, informed, and unambiguous as per Article 4(11) of the GDPR.
Multiple purposes
Data controllers must allow individual cookie selection by purposes and the user’s consent must be specific to each purpose of the cookie.
Easy withdrawal of consent
Data controllers must allow users to withdraw their consent to the processing of cookies via a user-friendly and easy method.
Compliant cookie banner
In order to ensure that the cookie banner complies with the applicable legal requirements, data controllers must give equal prominence to “accept” and “reject” buttons on the cookie consent banner. Moreover, the cookie banner must contain a link to the privacy policy and cookie policy providing detailed and further information. The use of wordings such as “by your continued use of the website – either through clicking, using, or scrolling it – consent to the processing of cookies will be assumed” is not allowed.
