Author: Miroslav Eckart, Data Protection Officer Datainfo.si, doo
Google is especially under attack, especially Google’s analytics cookies, and of course Facebook. The French watchdog CNIL imposed fines on Facebook and Google in the total amount of 210 million euros. If the issue is not satisfactorily resolved within three months, an additional daily fine of €100,000 will be charged for each day of delay.. The Austrian Supreme Court has declared the use of Google’s analytics cookies illegal. Even the European Parliament has been reprimanded for using Google Analytics cookies.
Slovenia is also fully geared to changing the “in force” regulations for cookies, as recently (December 2021) the Government of the Republic of Slovenia approved a proposal for a new electronic communications law ZEKOM 2. The law is on its way to the National Assembly.
It is about » technical or. A non-political law, so don’t expect much partisan disagreement when the law is passed. An explicit change compared to the current regulations in ZEKOM 2 is that according to the new Article 225 of ZEKOM 2, instead of referring to the current Personal Data Protection Act (this is our current law and due to the partially invalid GDPR ZVOP 1) complies with personal data protection legislation.
The applicable legislation also includes the European Union General Regulation on the Protection of Personal Data (GDPR .).), which will celebrate its four-year anniversary on May 25, 2018.
What exactly are cookies?
Cookies are small text files that are stored on the user’s device. We know of several types, and they are usually divided into urgent and non-essential cookies. Necessary cookies are those that a website needs to function properly. However, there are several types of non-essential elements and they are divided into analytic, tag, trace, etc.
It is now clear from all these provisions, decisions and penalties imposed that the legal basis for the use of non-essential cookies is classic consent, according to Articles 4 and 7 of the GDPR.
This means that user consent must be clear, voluntary, specific, informed and unambiguous. So solutions such as cookie notifications are not entirely appropriate, such as: “Our website contains cookies, find the appropriate settings in your browser and turn them off yourself.”
Example of bad practice
There is also no coherent solution from one of the most “busiest” Slovenian websites:
When you click Settings, the following appears:
Such an arrangement is very problematic because the fields are pre-filled/selected, which is in direct conflict with GDPR requirements.
Thus, it is very important that users have a fair chance to say yes or no in the same way (eg with the same number of clicks). Users should also be able to revoke their consent very easily.
Instead of concluding, I recommend that to avoid censorship procedures and pay fines, edit your website with full consent regarding cookies and GDPR information, as inspectors do not have to leave offices (home) for censorship procedures because all your information (and breaches) visible to the public. / 7 online.