The Government's ICT Strategy
Last month, the Coalition Government announced changes to central Government ICT strategy which it is hoped will pave the way for the delivery of efficient, cost effective public services. Significant challenges have been identified including the insufficient integration of infrastructure, over capacity, especially in data centres and long and costly procurement timescales.
The strategy will require some new thinking. Of particular interest:
- Creation of a cross-public sector Applications Store;
- Shared common infrastructure of the Government Cloud (G-Cloud) to play an increasing part in cutting costs and delivering services.
Both these initiatives will be a reflection of the trend in business, generally, to move to a more service-orientated delivery providing greater flexibility.
A strategic implementation plan to be produced in collaboration with departments and HM Treasury is due to be published by summer 2011.
Cookie, anyone?
The Issue
Online behavioural advertising. The EC Privacy and Electronic Communications Directive (the "Directive") is due to become UK law by 25 May 2011. Draft regulations are expected any time now, (referred to as the "e-Privacy Regulations" in this bulletin). If the Directive is reflected in the e-Privacy Regulations as is, you will no longer be able to place cookies automatically on a user's computer (assuming they have not opted out, of course). You will need the prior consent of customers to be able to set cookies, having provided them with clear and comprehensive information about the purposes of the processing in a user-friendly way. Cue pop-up consent windows every time a consumer comes to your site. Cue more pop-ups for consent to third party advertising cookies... An exception is cookies that are "strictly necessary" for the provision of a service "explicitly requested" by the user – so cookies can take a user from a product page to a checkout without the need for consent.
The Government is not keen on an opt-in system for cookies, fearing disrupted services for users and substantial losses for online providers - costs in programming pop-up windows or other means to obtain consent and lower advertising revenue and lost sales from users choosing not to allow cookies.
The Possible Solution?
A related EU directive, the Citizen's Rights Directive, suggests that, where technically possible and effective, one-off consent when a consumer sets up their web-browser is sufficient. Whilst this approach is favoured by the Government, they plan to implement the relevant provisions of the Directive, together, possibly, with clarification about the browser let-out and leave it to the Information Commissioner's Office to issue guidelines. The independent EU Advisory Body on Data Protection and Privacy does not deem the use of privacy policies in conjunction with browser settings sufficient to comply with the obligation on data controllers to obtain prior, informed consent, if the browser default is set to accept third party cookies without further user involvement.
So what?
It's a muddle. The Directive requires that Member States include effective, proportionate and dissuasive penalties (including criminal sanctions) for any breaches of the national provisions implementing the Directive. So far, we have some guidance in the form of an EU Framework for Online Behavioural Advertising from the Internet Advertising Bureau. We have yet to see what these penalties are for UK business.
Post 25 May 2011, do you risk failing to seek consent before the cookie is loaded, which could constitute a breach of the e-Privacy Regulations, enforced by the Information Commissioner, and could result in the commission of a criminal offence and individuals being entitled to compensation? Don't forget the reputational damage. Or, pre-26 May 2011, do you err on the side of caution, incurring costs and potential decline in revenue by creating pop-ups?
The contents of this article are intended as guidelines for clients and other readers. It is not a substitute for considered advice on specific issues. Consequently, we cannot accept any responsibility for this information or for any errors or omissions.
Thomas Eggar LLP is a limited liability partnership registered in England and Wales under registered number OC326278 whose registered office is at The Corn Exchange, Baffin's Lane, Chichester, West Sussex, PO19 1GE (VAT number 991259583). The word 'partner' refers to a member of the LLP, or an employee or consultant with equivalent standing and qualifications. A list of the members of the LLP is displayed at the above address, together with a list of those non-members who are designated as partners. Regulated by the Solicitors Regulation Authority. Lexcel and Investors in People accredited.
Thomas Eggar LLP is not authorised by the Financial Services Authority. However, we are included on the register maintained by the Financial Services Authority so that we can carry on insurance mediation activity which is broadly the advising on, selling and administering of insurance contracts. This part of our business, including arrangements for complaints and redress if something goes wrong, is regulated by the Solicitors Regulation Authority. The register can be accessed via the Financial Services Authority website. We can also provide certain further limited investment services to clients if those services are incidental to the professional services we have been engaged to provide as solicitors.
Thesis Asset Management plc, our associated financial services company, provides a comprehensive range of investment services and advice. Thesis is owned by members of Thomas Eggar LLP but is independent of and separate to it. No lawyer connected with Thomas Eggar LLP provides services through Thesis as a practicing lawyer regulated by the Solicitors Regulation Authority. Thesis is authorised and regulated by the Financial Services Authority. Thesis has its own framework of investor protection and professional indemnity cover but Thesis clients do not enjoy the statutory protection of solicitors' clients.