UK Legislation and Cookies?

[tsrplatelayer]

Thanks DW - I agree - who getter to tell us exactly how Zen uses cookies - and I will need that information if I am to seek legal opinion as to the exemption status of Zen's use of cookies when related to the legislation.

The new guidelines also indicate that both long lived cookies and session cookies are subject o this legislation

[MikeyG]

The deadline is looming and the UK press are picking up on the fact that even the Government might miss this deadline. That aside has anybody got to the bottom of whether an opt out option is required and has this been implemented. Can Zencart run with out cookies and if so how do we turn it off? What is the difference between a cookie and the session ID and is the session ID in a table? Does it require the cookie to be able to work?

[dgent]

I really wouldnt worry about this until they are beating down your door. There is a major law/rule that you can't keep credit card numbers stored - have you ever been audited and this checked? Do you know anyone else that has? Do you even think they have the power to check? This is one of those things that isnt going to take years to properly enforce (if ever)

And to be honest, the standard Zencart install that has card processing through a verified processor (such as Paypal) is fine.

[keneso]

That aside has anybody got to the bottom of whether an opt out option is required and has this been implemented.

I had opened a thread asking help in installing it:
http://www.zen-cart.com/showthread.p...icting-cookies

If anyone manages to do so, please explain me.
Thank you.

[DrByte]

General information about Zen Cart's very simple use of cookies is already here: http://www.zen-cart.com/content.php?317-cookies

NOTE: As the article says, it is NOT legal counsel. And anything you've added to your store needs to be assessed and disclosed according to whatever rules apply to you. The onus is entirely upon the individual storeowner.

The article is also not UK-specific.

And I would also add that, as the article says, it is not suitable to consider yourself absolved of responsibility by merely engaging in a copy-and-paste of the article into your own store's "privacy policy" etc.

You really do need to seek your own independent legal counsel to ensure that your own store's policies properly disclose the complete representation of your store's operation as required by the laws which apply to you.

[dw08gm]

Many thanks Dr Byte.

[JSWeb]

Now the BBC is broadcasting 'Action needed' to meet UK's cookie tracking deadline

http://www.bbc.co.uk/news/technology-17745938

And for some of the clients we work with, an audit is already on the cards.

Thanks DrByte for the General information about Zen Cart's very simple use of cookies is already here: http://www.zen-cart.com/content.php?317-cookies

[dgent]

Quote:

'Amid criticism that hardly any UK government websites comply with the new EU-mandated "Cookie Law" that comes into force on 27 May, the ICO has announced that it will be sending out some letters, and then waiting for people to complain.

The ICO will send out 50 letters to the UK's biggest websites over the next few days, its deputy commissioner, David Smith, has announced. At a press conference this morning, Smith said the ICO planned to ask the sites to show that they are asking users' consent for any cookies the websites are using to track their behaviour.

After that, the ICO will wait for users to complain about cookies on particular sites before investigating individual organisations for breaching the data protection law.'

http://www.theregister.co.uk/2012/05/18/cookie_law_ico/

[JSWeb]

Looking more into the ICO Cookie Legislation, there is an interesting statement from the ICO which say

Exceptions are likely to be made if the cookie is only being used to ensure a page loads quickly by distributing the workload over several servers, or is employed to track a user as they add goods to a shopping basket.

Based on Zen Cart's very simple use of cookies (outlined at: http://www.zen-cart.com/content.php?317-cookies ) it would be a positive move for the ZC Team to contact ICO (EMAIL: [email protected]) to outline ZC's use of Cookie to get a confirmed response of acceptance or outlined actions

How does that sound?

[wilt]

Should we also be contacting the equivalent organisations in Gemany, France etc, given that they will in all probabliity have a slightly different interpretation to the UK's ICO.

The full ICO guidance is available here. (Note PDF Download)

There is also an interesting take on the regulations here.
In particular category 3, which seems to cover the cookie used in an unmodified Zen Cart store,

And finally a quote from a German IT Blog I was reading the other day.

Either way, if you look at how differently France (even analytics cookies are “necessary”) and the UK (fewer cookies are “necessary”, but implied consent suffices) not so much transposed the Direcitve into national law but interpret their own national laws in light of the Directive, and if you take into account that Germany so far seems to have no idea at all how transpose the Directive at all, the Directive’s ultimate goal – harmonising the law throughout the EU – is very unlikely to be achieved.