The Council of the EU does not intend to follow the European Parliament’s stance on banning “cookie walls” (where users who do not want to be tracked – by means of cookies, for example – could be denied access to a web site or an app). That is according to the Bulgarian Presidency’s latest draft compromise ahead of the working group meeting on 28 March.
The draft regulation seeks to enhance the confidentiality of online exchanges while allowing service providers to use the personal data of those clients who have previously given their consent (see EUROPE 11700). The European Parliament adopted its position in October of last year (see EUROPE 11887).
Things are taking longer for the Council. The most controversial issues relate to the processing of data without prior consent and privacy settings. On 22 March the Bulgarian Presidency submitted a fresh draft compromise to the national delegations focusing on the protection of end users’ terminal equipment information (8), privacy setting (10), publicly available directories (15) and unsolicited marketing communications (16).
Protection of information and cookies. The Bulgarian text proposes stating, in a recital, that access to a web site may be made conditional on the well-informed acceptance of a cookie or similar device “if it is used for a legitimate purpose”. It also clarifies that a one-off consent for a cookie in the context of one website is possible: “The end-user’s consent to storage of a cookie or similar device may also entail consent for the subsequent readings of the cookie in the context of a revisit to the same website domain initially visited by the end-user”.
Amendment of Articles. In terms of the substance of the proposal, the Bulgarian Presidency suggests amending Article 10 to state that the end user need not be required to regulate the privacy settings upon installation or first usage. The proposal suggests insisting on the need to inform the end user of the possibility of choosing a setting and on periodic reminders about the privacy settings.
The Presidency also proposes a new Article 16 (2a) which allows member states to set a time limit for using customers’ contact details for direct marketing. In Article 16 (6a), it explicitly excludes from the provisions on unsolicited communications marketing, advertisements on websites that are displayed to the general public and do not require end-users’ contact details.
The Presidency’s draft compromise can be viewed at: https://bit.ly/2GeW1g7 (Original version in French by Sophie Petitjean)