Info Law Group : Technology Lawyers & Attorneys : Information Law Group : Privacy, Security & Intellectual Property Law

Cookies Everywhere

“Cookies,” small text files that a website automatically places on a visitor’s computer when the website is loaded, are ubiquitous on the Web. Session cookies track a user’s activity from page to page during a session, so that the user does not have to re-enter information or selections. Authentication cookies store logon credentials so that the user does not have to log on again after navigating to another website. Persistent cookies store user preferences for each successive visit to the website.

Tracking cookies may be used to collect analytic data on how an individual website is used, and some kinds of tracking cookies record the user’s activity across websites – which is more controversial from a privacy perspective. For example, “conversion tracking cookies” allow an advertiser to determine whether a user who clicks on a third-party advertising link ends up making an online purchase from the advertiser. Some behavioral marketing programs use cookies to collect information about the pages and sites visited by a consumer so that a profile can be constructed for targeted marketing purposes. Google Analytics uses cookies to create statistical reports for advertisers and website operators, without identifying the individual users other than by IP address.

The ePrivacy Directive

The European Union’s Privacy and Electronic Communications Directive (the “ePrivacy Directive”) essentially required transparency concerning cookies. Website visitors were to be informed about the website operator’s practices and available options to refuse or delete cookies. This has been the standard for website operators and advertisers since 2002.

In November 2009, the ePrivacy Directive was modified by amendments that included a revised Article 5(3) emphasizing the need for informed consent:

Member States shall ensure that the storing of or access to information already stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information in accordance with Directive 95/46/EC [the EU Data Protection Directive], inter alia about the purposes of the processing.

There is an exception for storage or access that is “strictly necessary” to provide an explicitly requested service.

The UK Response

Member States were required to transpose the amendments into national law in 18 months. This explains the timing for the revision of Regulation 6 of the UK Privacy and Electronic Communications Regulations 2003 (“PERC”), which will require after May 25 that the user “has given his or her consent” to storing or accessing information on the user’s equipment.

ICO’s announcement this week concerning the rule change raises as many questions as it answers, and the announcement itself states that ICO will issue separate guidance on how it intends to enforce PERC with respect to cookies.

Key Issues

• ICO expects that the more intrusive cookies (such as those that create profiles of users, especially across multiple websites) will require more explanation and well-documented consent. Conversion tracking and behavioral marketing uses of cookies are clearly in the crosshairs.

• The recitals to the amended ePrivacy Directive discuss the possibility of relying on the user’s browser settings to accept or reject cookies. ICO rejects this as a current solution, however, given the variety of browsers and settings in use, their unfamiliarity to many users, and the increasing use of mobile devices to access websites.

• ICO mentions several other possible ways of informing users about cookies and obtaining consent, such as highlighted or scrolling headers, footers, or splash screens; disclosures on pages requesting personal information or offering particular downloads such as videos; website terms and conditions or pop-ups that require a user to click “I agree” before proceeding; website “settings” that could be selected by a user once and then remembered (presumably using a cookie) for subsequent visits.

• ICO frankly acknowledges that third-party cookies may present the most challenging compliance issues and simply concludes that “everyone has a part to play in making sure that the user is aware of what is being collected and by whom.” An ICO spokesperson mentioned the possibility of establishing advertising network policies and procedures that could be viewed (and consented to?) by clicking on an icon displayed with banner ads and other advertising links.

• ICO says the exception for “strictly necessary” cookies will be interpreted narrowly. It gives one potential example: cookies used to keep track of a user’s purchases in a “shopping basket” until the user is ready to “check out” and pay for the purchases. ICO advises that it would not be acceptable to use cookies without consent simply to make the presentation of the website more attractive or collect statistics about the use of the website.

Implications for Website Operators

• Websites hosted in Europe are clearly subject to the new rules as they are implemented in each country this year. Data protection authorities and courts in some European countries may also assert that websites hosted elsewhere but targeting European residents should conform to the new cookie rules. When a company offers a UK or EU version of a website, for example, it may be required (or at least expected by users) to follow the EU rules.

• The trend toward requiring fuller disclosure and explicit consent, especially for behavioral tracking, is likely to be seen in the US as well, as suggested by the Federal Trade Commission’s December 2010 report on consumer privacy.

• Website operators should stay abreast of official interpretations and enforcement policies, such as those promised by ICO, that may offer more detailed guidance on cookie notices and consent mechanisms.

• It’s a good time to inventory your organization’s cookie practices, make sure they are fully disclosed in website privacy policies, and consider how to operationalize express consent requirements in Europe.  Watch how popular commercial websites in the UK adapt to the new rules.  (Right now, even the privacy policy on ICO's website would be inadequate!)

• Contracts with third-party advertisers, advertising networks, providers of website and browsing statistics, and business partners involved in co-branded websites should clearly delineate who is responsible for providing cookie notices and obtaining (and preserving evidence of) consent where required.

European Context

The European Union’s venerable Data Protection Directive, adopted 15 years ago, has had a huge impact on data privacy and security practices in the European Union and in the countries outside the EU, ranging from Russia to Canada to Japan, that have adopted national data privacy laws strongly influenced by the Directive. The Directive’s comprehensive approach to personal information privacy, based on widely accepted principles of fair information practices, contrasts with the US approach of legislating conditions on the collection and use of personal information only in specific contexts such as Social Security Numbers, credit reporting, financial accounts, and electronic health records. While the two systems sometimes produce similar results, the mismatch between Euro-style comprehensive data privacy laws and the detailed but sectoral regulation in the United States creates some challenges for organizations that conduct business across borders.

The EU Directive (Articles 25 and 26) directs member states to prohibit the transfer of personally identifiable data to countries whose laws are not deemed sufficiently similar, unless some other approved means of assuring adequate protection is employed. One response to the problem of assuring privacy protection overseas was the adoption of EU-approved standard contract clauses or “model contracts,” which were recently updated to better address the trend toward outsourced subprocessing (including cloud computing). Another was the EU-US “Safe Harbor” framework developed jointly by the European Commission and the US Department of Commerce, under which American companies can publicly certify compliance with a standard set of Safe Harbor Privacy Principles approved by the European Commission and enforced by American regulators, predominantly the Federal Trade Commission.

Some data protection officials in Europe have questioned whether these legal alternatives have been wholly effective in assuring the confidentiality and security of personal information from Europe that is stored or processed in the United States or other countries. Social networking and the popularity of cloud computing models for outsourcing data storage and processing have heightened these concerns, since there is often less clarity about where personal data are stored and by whom. Such concerns underlie the recent pronouncements by the German data protection authorities.

Behind the Drama

Dr. Weichert shows a flair for drama in calling for the immediate end of Safe Harbor and characterizing cloud computing users as scofflaws. His press release on Safe Harbor acknowledges that his radical proposal is unlikely to be adopted because “nobody in the EU seems to have the courage” to disrupt the close economic relations with the US. He complains that Google, Facebook, and other American companies encourage millions of Europeans to share personal information, without effective supervision or recourse. Dr. Weichert wants to reopen negotiations on the Safe Harbor principles and at least strengthen the enforcement mechanisms. An upcoming EU consulting report on Safe Harbor is likely to provide some ammunition for that argument, as it reportedly criticizes the FTC for taking action against only seven companies in the ten-year history of Safe Harbor, despite thousands of complaints.

On cloud computing, Dr. Weichert points out that customers do not always know where their data resides and who is handling it, making it impossible to assure compliance with the notice, security, and transborder obligations of data controllers under the national laws transposing the EU Data Protection Directive. Individual data subjects are supposed to be informed of material facts concerning the processing of their data, and this is usually interpreted to mean, among other things, that they must be told if the data are being processed outside the EU in countries with dissimilar legal protections for personal information. In such cases, the data controller is also responsible for assuring an adequate level of protection through model contracts, Safe Harbor, binding corporate rules, informed consent, or other approved methods. Where a cloud services provider is acting as a “processor” of the data on behalf of the European customer or data “controller,” which is typical in cloud computing arrangements, the data controller has an obligation under the national version of Article 16 of the EU Directive to conduct due diligence in selecting a provider and engage the provider with a written agreement that (a) forbids the processor from acting on the data other than according to the controller’s instructions and (b) requires the processor to maintain appropriate technical and organizational security measures. Dr. Weichert questions whether this routinely happens when a customer signs up for cloud services that are, in fact, provided in a variety of changing locations and sometimes by layers of different companies providing hosting facilities or software as a service (SaaS) applications.

Putting the Criticism in Perspective
 

State and national data protection authorities in Europe remain legally obliged to allow data transfers to Safe Harbor companies in the US, as the Safe Harbor decision was adopted through a legislative procedure requiring approval by the European Commission, consultation with the European Parliament, and a weighted majority vote by the member state governments. Any revision of the Safe Harbor decision must follow a similar process, even assuming the US were willing to reopen discussions on the jointly administered program. Thus, modifying or terminating the program would require extensive debate and negotiation. Meanwhile, state or national authorities can legitimately confirm that a company is currently certified under Safe Harbor, but they cannot prohibit data transfers simply because the parties rely on Safe Harbor rather than model contracts or another legal basis for transborder data flows from Europe.

Moreover, the Safe Harbor program has successfully attracted nearly 2000 American companies, including those that represent some of the largest trans-Atlantic data flows, and it is now paralleled by a virtually identical US-Switzerland Safe Harbor Framework. US and European authorities meet periodically to discuss the program and coordinate efforts to promote and enforce it. The Department of Commerce and the FTC are both engaged with European data protection authorities in this process, and any perceived gaps in enforcement are likely to be addressed in this dialogue rather than in an overhaul of the Safe Harbor Privacy Principles themselves. In a public conference on Safe Harbor held in Washington last November, European data protection authorities expressed satisfaction that the program had raised the awareness of American companies handling European personal information and helped ensure compliance on the part of the European entities collecting and using the data.

Similarly, although several data protection authorities have highlighted potential compliance problems with cloud computing solutions, none have taken legal or administrative action to prevent European companies from using them (not even in Schleswig-Holstein). Dr. Weichert participates in the Düsseldorfer Kreis, where his office takes the lead on examining insurance industry issues, but the group has not issued an opinion on the application of transborder data protection mechanisms to cloud computing. His comments, which have not been officially endorsed by other regulators, should be viewed as a caution to European cloud customers rather than as a legal or enforcement opinion.

Lessons for Global Companies

The German state authorities' comments come at a time when national data protection authorities in Europe are debating precisely how the EU Data Protection Directive should be updated to reflect developments in technology and information practices since the Directive was adopted 15 years ago. The European Commission had announced its intention to review scores of written comments submitted in a recent consultative process and then propose legislative revisions later this year. But the national DPAs, meeting with the Commission last month, prevailed on the Commission to postpone any proposals until mid-2011, according to an August 2 announcement by CNIL, the French data protection commission, which was later confirmed by EU Commissioner Viviane Reding. The Commission and the national authorities are reportedly concerned about divergences in national approaches in implementing the Directive and want to examine how best to apply the general principles of the Directive in an increasingly global, networked, and distributed computing environment.

Global companies must continue to assure compliance (and market acceptance) as they collect consumer data from users in Europe and handle European employee data in centralized enterprise resource management systems or outsourced applications. Safe Harbor is an efficient and widely accepted option for the companies themselves and for many of their vendors, and cloud services are often practical and cost-effective. However, given the concerns of European authorities (and possibly of European consumers and legislators), companies should carefully consider how to implement these solutions in a compliant manner:

• Keep Safe Harbor certifications up to date (they must be renewed annually) and make sure they accurately disclose the range of data transfers to be covered

• Conduct the required annual assessment of Safe Harbor compliance

• Publish a Safe Harbor privacy policy with conspicuous provisions for resolving individual questions and complaints

• Verify that US vendors (including cloud service providers) are Safe Harbor certified, or alternatively use EU-approved standard contract clauses

• Keep European personal information, especially sensitive data, out of any cloud or outsourcing arrangements with vendors that cannot or will not confirm compliance, recognizing that some vendors refuse to divulge their locations or sub-contractors

• Follow Dr. Weichert’s advice (and ours) to include a Security Service Level Agreement, Information Security Schedule, or other specific security requirements in any outsourcing or cloud agreement that involves European personal data.
 

When I was a kid in Las Vegas, I had a “pen pal” in France. We exchanged the occasional letter, painfully translating into each other’s languages and then trying to figure out how much postage to stick on the envelope. It seems quaint now.

Thanks to Facebook, LinkedIn, and Twitter, I’ve enjoyed meeting people with similar interests and reconnecting with people I knew socially or professionally in years past, in several countries. It’s usually pretty easy to look up people as you think of them, and there’s no postage and little delay.
Those services, and an array of other social media, have become truly international. Some 15% of the world’s Internet users are American, so even successful social media operators in the US naturally look abroad to expand their increasingly monetized networks. Competing with national and regional social networks throughout the world, leading social networking providers in the US, Europe, China, and India have turned social media into a global phenomenon. To take one prominent example, US-based Facebook now translates into more than 100 languages and reported this month at InsideFacebook.com that nearly 70% of its hundreds of millions of users reside outside the United States.

Facebook aggregates users’ self-reported demographic data and sells the information to advertisers, who are understandably eager to tap the advertising possibilities of social media.  In several developed countries, a third or more of the population uses Facebook, many on a daily basis.

Facebookers and other social networkers often end up sharing a large amount of personal and professional information over time with friends . . . and friends of friends, and friends of friends of friends, and ultimately with a lot of people they wouldn’t recognize across a restaurant. By some estimates, roughly a third of Facebook users ultimately divulge their home address and current employment to an unknown number of people who are perhaps not all really their friends. New York Senator Charles Schumer recently called on the Federal Trade Commission to develop guidelines for social networking sites, and the FTC has already had occasion to investigate the extent to which identity theft and fraud are attributable to bad hygiene, or bad policies, in social media.

Most of the social networking groups I belong to are professional ones, linking lawyers, business people, inventors, IT managers, academics, and government officials who share certain interests and follow developments in particular fields. Those who participate often share ideas and some personal and career information, and they sometimes comment about their own companies or organizations or the offerings of their competitors.

So, as a lawyer, it strikes me that some social networkers may be exposing themselves not only to embarrassment and unwanted solicitations but also to fraud or identity theft. They also may be setting themselves up for trouble with prospective employers, or with their current employers or business partners who feel the talkative social networker has violated confidentiality policies or nondisclosure agreements (in surveys, many large US employers acknowledge that they have fired or disciplined employees for the contents of their posts or blogs). Advertising thinly disguised as a Tweet or post may not conform to advertising rules in all the relevant states, provinces, or countries. An intemperate rant or sly aside, broadcast to a few hundred of the user’s “closest friends,” raises the potential of liability for defamation or commercial disparagement. Comments about associates or coworkers, especially in the context of social media that blur the lines between personal and professional life, may trigger sanctions under privacy and data protection laws. And thanks to the global nature of social media, the hapless social networker could conceivably run afoul of laws in multiple jurisdictions.

It’s not only the FTC that has started worrying about the dark side of social media. The Article 29 Data Protection Working Party (comprised of EU authorities and European national data protection commissioners) issued a statement this month declaring that Facebook’s new default privacy settings are dangerous. The group has also warned social media applications developers (such as FarmVille) to be careful in their handling of user data. Regulators on both sides of the Atlantic have expressed concern as well about behavioral marketing applications based on gathering information about an individual’s participation in social media.

It’s easy to over-react to the hazards of social media, of course. Some parents forbid their children from joining in (and some teens have created a “safe” MySpace page that their parents can see, while secretly maintaining a more dubious version to share with their peers). Some users decide to drop out entirely, finding the risks, or just the implied obligation to post and respond frequently, unmanageable; there is even a “Quitting Facebook” Community Page on Facebook itself. Reasonably careful social networkers simply look at the privacy policies and options and adjust their settings appropriately to their intended use – and then watch what they say about employers, competitors, and other sensitive types. Some corporations have blocked access to social networking sites from company computers and adopted policies against their employees saying, well, pretty much anything about the company or its competitors or regulators. But other companies have already designated a “director of social media” to help the organization make effective use of social networking, internally and externally.

It seems that the trend is for employers to expand their “acceptable use” policies on email and web browsing to encompass blogging and social media as well. This is a necessary step, but it is also fraught with concerns arising from labor law, privacy law, and rights of association and free expression, and the rules differ across the many jurisdictions that may be at issue.

It is possible to set some boundaries that will pass muster just about anywhere and articulate policies that guide employees toward safe and sensible use of social media. There is much to be learned in the way of evolving best practices, especially among large multinational employers. Just don’t forget to check with a knowledgeable lawyer when crafting such policies and determining how to enforce them.