BIS has issued a consultation on implementation of the revised E-Privacy Directive which requires a number of changes to English law. The consultation seeks views on some of those changes:
- Data security breach notification. The Government proposes to copy the revised wording of the Directive which requires providers of public communications services to notify the national regulator of any "personal data breach". The ICO will be authorised to provide guidance on the notification mechanism.
- Penalties. The existing enforcement regime under the Data Protection Act is being reviewed by the Government and ICO. The consultation seeks views on the additional sanctions in the revised Directive, together with comments as to how the provisions of the Directive could be better enforced.
- Cookies. A controversial subject mentioned in previous bulletins. The Government proposes to replicate the wording of the E-Privacy Directive. It is against the establishment of an opt-in system for cookies which it considers would lead to a permanent disruption of services. It intends that online providers will be permitted to take advantage of the provision in Recital 66 (of the Citizens Right Directive, which is being brought in at the same time) that states that users' consent to cookies may be expressed by way of browser settings. The ICO is to be left with the flexibility to adjust to changes in usage and technology. This approach is at odds with that adopted by the Article 29 Working Party which has demanded stricter opt-in standards for cookies. This subject is set to run and run.
- Information provision. This relates to the requirement on service providers have procedures in place to supply the police and security services with details of usage of electronic communication services – including what is presently required under the Regulation of Investigatory Powers Act 2001. The Government proposes that the ICO should have the ability to question communication providers about their procedures. Providers would be expected to bear the cost of implementing the procedures.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
