On 10 June, the Italian Data Protection Authority approved the new ” Cookie Guidelines.”The term cookie refers to a small text file that a website (publisher or “first party”) can autonomously send to the user’s device (e.g. Smartphone, PC or Tablet) when viewing a web page or different sites or web servers (“third parties”). Usually, cookies make it possible to store the preferences expressed by the user so that they do not have to be re-entered later. The browser saves the information and transmits it to the site’s server when the user visits that website again.
The Guidelines, adopted by the Data Protection Authority, considered what emerged during the public consultation promoted at the end of last year. The guidelines aimed to strengthen users’ decision-making power over the use of their data when surfing online.
Here are the main changes.
Under Regulation (EU) 2016/679 on the protection of personal data (better known as the “GDPR“), the policy to be issued to users/data subjects shall specify (i) possible recipients, (ii) the retention periods of personal data processed and (iii) a description of all the consequences of any action taken by the user/data subject.
The Data Protection Authority recommends that Analytics cookies, which the Data Controller uses to assess the effectiveness of a service, be used only for statistical purposes.
The multi-layer privacy policy is confirmed, with a banner (short policy) when accessing the site containing specific information on positioning, size, font and content, and a link to the extended policy.
The user/data subject must choose between consent or modulating their preferences on tracking and be provided with a link to another area to select the functions, third parties and cookies, possibly grouped by similar categories, to the use of which the user consents.
The mere “scrolling down” of the page cursor is unsuitable for the collection of an appropriate consent to the installation and use of profiling cookies or other tracking tools by the data controller.
Given the controller’s autonomy in identifying the most appropriate solutions to achieve compliance with data processing regulations, the Data Protection Authority invites the controller to assess every possible solution rigorously. According to the Data Protection Authority, if the user action does not correspond to any unmistakable, documentable computer event with the mentioned features, including user awareness, it will be impossible to attribute the consent validity under applicable regulations.
Obtaining consent for cookies may not be repeated unless (i) the processing conditions change significantly, (ii) the site operator can’t record the user’s previous choice due to a user decision and (iii) at least six months have elapsed since the previous request.
Users/data subjects shall be provided with the ability to review choices made at any time and in a simple, immediate and intuitive manner. This can be done using a dedicated area made accessible through a link placed in the footer of the site that makes the function explicit and says “review your choices on cookies” or similar.
Website owners have six months to comply with the principles contained in the Guidelines.
Other related insights:
On 10 December 2020, the Italian Data Protection Authority (“Guarantor“) launched a public consultation on the “Guidelines on the use of cookies and other tracking tools“ (the “Guidelines“) drafted on 26 October.
The Guarantor follows indications provided by the European Data Protection Board (“EDPB“) in the “Guidelines 5/2020 on consent under Regulation (EU) 2016/679” of 4 May 2020.
Cookies are small strings of text that websites (publishers or “first parties”) visited by the user or different websites or web servers (“third parties”) place and store on the used device (e.g. Smartphone, PC or Tablet). Cookies allow to collect information and improve the user/data subject’s navigation.
Regulation (EU) 2016/679 on personal data protection (“GDPR“), while not directly modifying the rules on such tracking tools, regulates the personal data processing consent. It established that the consent must be provided by data subjects through a “free, specific, informed and unequivocal manifestation of will“ (see Article 4, GDPR).
Under the “accountability principle”, this focuses on implementing data protection principles by design and by default, making it necessary to analyse the correct way of issuing online privacy policies to users/data subjects and acquiring their consent, where required.
The Guidelines, implementing what was stated by the EDPB, clarify that:
The Guidelines clarify that each data controller must provide data subjects/users with timely information on the processing of their data. This information must be provided on two levels: (i) short information notice or banner containing a link (ii) to the extended privacy policy.
After the public consultation directed at entrepreneurs, consumers, users and operators in the sector, and the analysis, followed by the possible implementation, of the comments received, the Authority will issue the final measure.
Other insights related:
