Cookies, the biter consent
SÉRVULO PUBLICATIONS 04 Dec 2019
Last October 1st, the Directorate-General for Communications Networks, Content and Technology (responsible to develop a digital single market to generate smart, sustainable and inclusive growth in Europe) was questioned about the requirements and conditions of consent under Directive 2002/58/EC in combination with General Data Protection Regulation (GDPR).
In the reply, it was reinforced that with the GDPR entry into force, the definition of consent was densified, requiring that it should be given in any appropriate way which allows a freely given, specific, informed and unambiguous indication of the data subject’s wishes, in compliance with the requirements of article 7 of the GDPR.
Furthermore, the recent judgement of the CJEU (commonly referred to as Planet49 case) establishes that consent for the storage and access of cookies in terminal equipment requires an affirmative action (not just by staying in the site or a pre-ticked box) for data to be collected (whether or not the information is personal data), and the service provider must provide the necessary information to let the user know the duration of the cookies and whether or not third parties may have access to those cookies.
Finally, the decision of the sanctioning procedure applied by the Spanish Data Protection Authority (AEPD) to Vueling Airlains, S.L., where it has been concluded that the option to "continue browsing" as a way to accept cookies is still possible as long as the user is given the option to oppose or decide which cookies allows or not.
Isa Rodrigues de Barros
Maria Francisca Gama
mfg@servulo.com
