What is data privacy?
Data privacy refers to the principle that individuals (known as ‘data subjects’) should have control over their personal data (ie information about individuals from which they can be personally identified, like names and addresses). This includes having control over how their personal data is processed (eg collected, stored or used) by businesses and other organisations.
Data protection considerations
The Data Protection Act 2018 (DPA) is designed to regulate the use of personal data by businesses and other organisations. The DPA is the main legislation implementing the UK General Data Protection Regulations (GDPR).
This legislation requires that anyone processing personal data ensures that it is:
-
used fairly, lawfully and in a transparent manner
-
collected for specified, explicit and legitimate purposes
-
adequate, relevant and its collection is limited to what is necessary
-
accurate and kept up-to-date
-
kept in a form that enables identification of data subjects for no longer than is necessary
-
handled according to the data protection rights of individuals, and
-
not transferred outside the UK without adequate protection (eg safeguards)
For more information on data protection, read Data protection, Data protection principles and Data protection for businesses.
What are internet cookies?
Internet cookies, often simply referred to as ‘cookies’, are text files placed on devices (eg computers or smartphones) by websites. They are used to collect personal data. Most website operators place cookies on the browser or hard drive of their website visitors’ devices for various purposes (eg to remember an individual’s website preferences, personalise their browsing experience, or for marketing purposes by tracking their browsing activity across different websites to show them targeted ads).
To learn more about cookies, including what different types of cookies exist, read Different types of internet cookies.
What do cookies have to do with data privacy?
Because cookies collect and store information about individuals’ online activities, they are closely related to data privacy. This means that anyone who uses cookies must comply with all relevant rules, including relevant data protection laws.
Cookies and the GDPR
The GDPR classifies cookies as a type of online identifier, which, in certain circumstances, is considered to be personal data.
If you use cookies to uniquely identify a device or the individual using that device, this is considered personal data under the GDPR. This means that cookies used for analytics, advertising and functional services come within the ambit of the GDPR.
To be GDPR compliant, you'll need to stop collecting cookies that uniquely identify individuals or find a lawful ground to collect and process the data, for example, consent (more on this below).
Privacy and Electronic Communications Regulations
The Privacy and Electronic Communications Regulations 2003 (PECR), also known as the Cookie Law, set out certain online marketing obligations and govern the use of cookies.
PECR sits alongside the DPA and GDPR and, where PECR applies, it takes precedence over the DPA and GDPR. This means that you need to consider PECR compliance before considering the GDPR.
In other words, if you operate a website, you should:
-
comply with PECR first, if your website stores information, or accesses information stored, on individuals’ devices, and
-
comply with the GDPR for any processing of personal data outside of such storage or access
Note that failure to comply with PECR can lead to fines of up to £500,000.
Consent for cookies
Under PECR, websites cannot use non-essential cookies unless the consent of the website visitor is expressly given. In other words, individuals visiting your website must opt-in before such cookies can be used.
Non-essential cookies are those which are not necessary for a website to function. They are often used for analytical purposes or to assist with advertising. Even cookies that customise a website (such as providing a greeting message) are deemed to be non-essential.
Essential cookies (also known as ‘strictly necessary cookies’) are those necessary for a website to function. They are generally those that enable an online checkout process to work properly or that are required for technical or security purposes. Using essential cookies does not require a website visitor’s consent, but it is good practice to ensure that information about these cookies is available.
Further, PECR sets out information requirements around cookies that you must comply with. This means that, in addition to getting consent, you must:
-
tell individuals about what cookies you use
-
explain what the cookies do, and
-
explain why you are using them
This must be done when an individual first visits your website.
Consent standard
PECR uses the GDPR’s standard of consent. This means that consent under PECR has the same requirements as consent under the GDPR.
This means that consent must be:
-
given freely and genuinely, and
-
given through a clear affirmative action, such as clicking an opt-in box or choosing settings or preferences on a settings menu. Simply visiting a website doesn’t count as consent
It must also be as easy to decline consent as it is to give it. There should always be a ‘reject all’ option that website visitors can click instead of giving consent, and this should be as obvious and easy to click as the option that grants consent. You must also give people the option to change their minds at a later date, ie by providing an opt-out option.
How is consent collected and information about cookies provided?
A cookie banner on a website’s landing page (ie the page a website visitor lands on) is typically used to collect consent for cookies and provide relevant information about cookie use.
Other methods (eg pop-ups, message bars or header bars) can be used. However, you must carefully consider how they will be implemented to ensure their useability and that they clearly communicate the situation regarding cookies to website visitors.
If you are using a cookie banner, this should:
-
inform website visitors about your cookie usage in plain and jargon-free language
-
set out the different categories of cookies (eg strictly necessary, functional and marketing cookies) your website uses
-
not have pre-enabled opt-in consent and instead provide both ‘accept’ and ‘reject’ buttons on the cookie banner
-
provide a granular option to accept/reject different cookie categories (eg under a ‘cookie settings’ button on the banner)
-
link to a compliant Website privacy policy with an integrated cookie policy or link to a separate Cookie policy on the cookie banner, so website visitors can find out more about the cookies used
-
be separate from other terms and conditions (including website terms of use)
The cookie banner should be displayed every time a given individual visits your website until they accept or reject all cookies or save their customised cookie preferences.
Once a website visitor has accepted or rejected cookies, the cookie banner should close (hiding the banner) or show a confirmation message along with a ‘hide’ button to let the visitors close the banner. The website visitor’s cookie preferences should be saved.
How long does cookie consent last for?
You do not need to get website visitors to reconsent to cookies each time they visit the website. How often a website visitor will need to reconsent depends on various factors (eg the frequency of visits or updates of content or functionality). However, you should ensure consent choices have a ‘shelf life’ and that your website asks for website visitors to reconsent to cookies after a certain period of time (eg 1 year).
For more information on data privacy and cookies, read the Information Commissioner's Office’s (ICO’s) guidance on the use of cookies and similar technologies. If you have any questions or concerns, do not hesitate to Ask a lawyer.
