Privacy & Information Security Law Blog

On June 24, 2010, the Article 29 Working Party adopted Opinion 2/2010 (the “Opinion”) providing further clarification on online behavioral advertising.  The Working Party also issued a press release on this topic.  Although the scope of the Opinion is limited to online profiling, its interpretation of Article 5(3) of the amended e-Privacy Directive provides some useful clarifications regarding the legal framework applicable to online behavioral advertising and the use of cookies.  We provide a short analysis of the Opinion below.

Opt-in?  Browser setting as opt-in?  Opt-out?  The Opinion clarifies the Working Party’s interpretation of the new Article 5(3) and Recital 66 of the e-Privacy Directive.  According to the Working Party, Article 5(3) and Recital 66, along with the General Data Protection Directive (“Directive 95/46/EC”), require prior opt-in consent since “prior opt-in consent mechanisms are better suited to deliver informed consent.”

For the Working Party, “consent” by default web browser settings may not be sufficient to comply with both the e-Privacy Directive and Directive 95/46/EC.  For browsers to deliver valid consent, they should (1) reject third-party cookies by default, and (2) convey clear, comprehensive and fully visible information.  Most web browsers do not currently meet these requirements.

The Working Party therefore encouraged ad network providers to create prior “opt-in” mechanisms, which require the users to accept (1) the storage of cookies and (2) the use of cookies to track browsing across websites in order to deliver behaviorally targeted advertising.  Furthermore, the Opinion states that consent must expire after a certain period of time, and that there must be a simple way for users to be able to revoke consent.

Finally, the user’s consent must be informed and the Working Party “considers that providing a minimum of information directly on the screen, interactively, easily visible and understandable, would be the most effective way to comply with this principle.”  Layered notices are mentioned as a best practice. Furthermore, information should be provided repeatedly using symbols or related messages appearing on the webpage to remind individuals that their behavior is being monitored.

Who is responsible?  Generally, advertisement network providers are responsible for compliance with both Directive 95/46/EC (since such providers typically would be considered the data controller) and the e-Privacy Directive.  The roles of website publishers may differ depending on context, and thus require a case-by-case analysis.  The Working Party acknowledges that although the website publishers may in some cases be considered data controllers, they may be subject to limited data protection obligations.  The Working Party emphasizes several times that in order to protect the privacy of individuals, cooperation between ad network providers and publishers is essential.  Cooperation with web browser developers also is crucial.

Additional obligations?  The Opinion also comments on the relationship between the e-Privacy Directive and Directive 95/46/EC, stating that “a law governing a specific subject matter (lex specialis) overrides a law which only governs a general matter (lex generalis).”  Therefore, Article 5(3) of the e-Privacy Directive which deals with informed consent will be directly applicable to online behavioral advertising.

Directive 95/46/EC will be fully applicable except for the provisions that are specifically addressed in the e- Privacy Directive, which mainly correspond to Article 7 concerning the legal bases for data processing.  The remaining provisions of Directive 95/46/EC also will be fully applicable.  Notable obligations include the obligation to properly inform individuals, the individuals’ rights, confidentiality and security of the processing, international data transfers and the purpose limitation principle (i.e., ad networks cannot enrich the information gathered for the purposes of behavioral advertisement with other information, unless the individual consent to such use).

Next steps?  The Opinion does not provide specifics with regard to the technological means for achieving the goals set out in the Opinion, but invites the industry to engage in a process of constructive dialogue, aimed at developing some technical and practical means for complying with the framework it sets forth.  Furthermore, the Opinion calls for input from interested stakeholders, who are encouraged to send their contributions to the Secretariat of the Article 29 Working Party.

The new e-Privacy Directive must be implemented in EU member states’ national law by June 2011.  It remains to be seen how each country will implement the new e-Privacy Directive’s Article 5(3) provisions, and whether they will follow the Working Party’s interpretation.