Chapter and Verse Blog

by Andrew Neilson

This weekend brings with it the 26th May 2012 deadline for compliance with the "Cookie Law." Although website owners will be spending this week working hard to ensure that they are up to speed with the ICO’s (Information Commissioner’s Office) expectations once Sunday arrives, enforcement of the directive is likely to be as reactive as it has been for previous regulations of its kind.

This is despite the fact that—as well as laying out new rules for how websites can deploy cookies and other similar tracking technologies—the PECR (Privacy and Electronic Communications Regulations) update has granted powers of enforcement to the ICO, including the right to impose monetary penalties of up to £500,000 on organisations whose websites are deemed to be in serious breach of the law.

The PECR update, originally issued on the 26th May 2011, has been widely referred to as the "Cookie Law" because the biggest change to the rules relates to how organisations use "electronic communications networks to store information—e.g. by using cookies—or gain access to information stored in the terminal equipment of a subscriber or user." The regulations require that websites consider the user's default position toward cookies—such as those on which Google Analytics relies—to be "opt-in" rather than "opt-out."

The ICO showed clear awareness of the magnitude of compliance work for website owners by announcing a year-long grace period. Some commentators interpreted this to mean that the ICO would begin concentrated enforcement of the directive at the end of this period.

Website owners and providers in the UK—including those of us at VerseOne—have been working hard, dedicating time and resource to making sure that we are following the letter of the law on our own sites and those of our customers.

Now that the ICO has revealed that they will continue to show a degree of leniency and flexibility towards non-compliance—even after their own deadline passes—the appropriateness of the regulations has come into question. Unsurprisingly, web marketers in particular continue to suggest that the update to the PECR is out of touch with the way that the web industry operates.

Others will simply be relieved that the ICO is not going to rule with a heavy hand, and perhaps take comfort in the fact that government websites themselves are struggling to achieve compliance before the deadline.

It is debatable whether the ICO will ever be able to enforce the directive effectively, but its position of leniency certainly reveals the scale, and the levelling effect, of the "Cookie Law" as all website owners find themselves in the same boat.

Web in the News

The Metro reported this week that Sir Tim Berners-Lee, creator of the internet and author of Weaving the Web, has criticised government proposals to require internet service providers to allow officials to examine electronic communications in real time.

His criticisms are rooted in concerns about privacy and the protection of personal data, as well as the potential for web communications data to be misused:

"It means that there will be information around which could be stolen, which can be acquired through corrupt officials or corrupt operators, and [could be] used, for example, to blackmail people in the government or people in the military.

"We open ourselves out, if we store this information, to it being abused."

Sir Tim is not the only prominent figure to object to the proposals; civil liberties groups and MPs from within the governing party have both raised concerns about the safeguarding of data collected through these channels and questioned the necessity of the proposals. The government believes the measures are necessary to identify and prevent terrorism and other criminal activity.

The web is a curious place: on the one hand, people are remarkably free and open with their personal data, on sites such as Facebook, Foursquare, and LinkedIn: you can often find birthdays, addresses, occupations, and even the current geographical location of a person listed quite publicly—all of which information could be used by fraudsters and burglars. And on the other hand, people are very sensitive about how corporations and the government and security services access and store the exact same personal data—for instance, through the use of cookies online.

These, and others, are issues we in the web space need to help provide solutions for, so that the web remains a method of knowledge-sharing and empowerment without compromising safety.

What accounts for these differences in approach to personal information on the web? Do you think the web is an exceptional means of communication? Or, are there ways in which the government's proposals equate to, for example, requiring the Royal Mail to allow them to read your post—and would you find that more or less intrusive?