UK Legislation and Cookies?

A law requiring websites to request the user's permission before storing cookies was due to be introduce in May 2011. Companies were given 1 year's grace to comply. Thus we may 5 months left.

Has anyone any input on how to make Zen compliant with this legislation?

See http://www.bbc.co.uk/news/technology-13541250

Advice appreciated.:unsure:

Thanks

http://www.zen-cart.com/forum/showthread.php?t=179776

Thanks - that didnt come up when I searched

6 months later - Is there any update?

What is there to update? Zen Cart does not store any sensitive information in the cookie.

I understand that the introduction of this legislation has been suspended. Like most crap coming out of the EU at Brussels, there is a belated realisation that it makes little or no sense to enact it.

What update - well...

Schoolboy says he believes it is suspended - does anyone have a specific reference to show tht is the case?

The guidelines published 6 months ago were draft - have they been updated?
Page 2 of http://www.ico.gov.uk/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf states explicitly that 'the new requirement is essentially that cookies can only be placed on machines where the user or subscriber has given their consent' - there is no allowance for the type of data stored in those cookies just - dont do it without consent.

Page 3 refers to services that have been 'explicitly requested' - but then lists an exception where the cokkie is 'strictly necessary for a service requested by the user' - this sounds like Zen may be exempt - but does anyone have a definitive opinion from a 'leagal eagle' to state that that is indeed the case?

Not trying to be rude here, but getting a legal opinion is up to you.

Agreed - but if someone has already asked the question it would be nice to know the anwer they were given

http://www.ico.gov.uk/news/blog/2011/half-term-report-on-cookies-compliance.aspx dated 13 Dec 2011 suggests that it has not been suspended and that new guidelines are available at http://www.ico.gov.uk/news/blog/2011/~/media/documents/library/Privacy_and_electronic/Practical_application/guidance_on_the_new_cookies_regulations.ashx

The new guidelines (see link in above) says
Page 5 states

Consent
The Regulations require that users or subscribers consent. Directive 95/46/EC (the Data Protection Directive on which the UK Data Protection Act 1998 (the DPA) is based) defines ‘the data subject’s consent’ as:
‘any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’.
Consent must involve some form of communication where the individual knowingly indicates their acceptance. This may involve clicking an icon, sending
an email or subscribing to a service. The crucial consideration is that the individual must fully understand that by the action in question they will be giving consent.

Pages 8-10 have some indicators to exceptions
Page 14 has an example text
Page 16 has a sample ‘get consent’
Page 18 seems to relate to accessibility settings
Page 23 says the regulations do not just apply where personal data is being processed

Kim:

What is there to update?

While I am aware of the existence of cookies, I know very little about their structure or the way they work.

Since you have asked, I consider the following would be most helpful:

i) A definitive statement from the Zen Cart team of which cookies do what in a default ZenCart installation. Better still if such statement could be inserted directly into the Privacy Policy or similar document of a default Zen Cart store, subject to modification by the store owner.

ii) A definitive statement from the Zen Cart team listing which existing mods have altered the default cookie and/or have introduced new cookies.

iii) A requirement placed upon future Mod authors that they state whether they have altered the default cookie in any way, and whether any new cookies have been introduced by them via the mod.

Cheers

Thanks DW - I agree - who getter to tell us exactly how Zen uses cookies - and I will need that information if I am to seek legal opinion as to the exemption status of Zen's use of cookies when related to the legislation.

The new guidelines also indicate that both long lived cookies and session cookies are subject o this legislation

The deadline is looming and the UK press are picking up on the fact that even the Government might miss this deadline. That aside has anybody got to the bottom of whether an opt out option is required and has this been implemented. Can Zencart run with out cookies and if so how do we turn it off? What is the difference between a cookie and the session ID and is the session ID in a table? Does it require the cookie to be able to work?

I really wouldnt worry about this until they are beating down your door. There is a major law/rule that you can't keep credit card numbers stored - have you ever been audited and this checked? Do you know anyone else that has? Do you even think they have the power to check? This is one of those things that isnt going to take years to properly enforce (if ever)

And to be honest, the standard Zencart install that has card processing through a verified processor (such as Paypal) is fine.

MikeyG:

That aside has anybody got to the bottom of whether an opt out option is required and has this been implemented.

I had opened a thread asking help in installing it:
http://www.zen-cart.com/showthread.php?176015-New-European-Law-restricting-cookies

If anyone manages to do so, please explain me.
Thank you.

General information about Zen Cart's very simple use of cookies is already here: http://www.zen-cart.com/content.php?317-cookies

NOTE: As the article says, it is NOT legal counsel. And anything you've added to your store needs to be assessed and disclosed according to whatever rules apply to you. The onus is entirely upon the individual storeowner.

The article is also not UK-specific.

And I would also add that, as the article says, it is not suitable to consider yourself absolved of responsibility by merely engaging in a copy-and-paste of the article into your own store's "privacy policy" etc.

You really do need to seek your own independent legal counsel to ensure that your own store's policies properly disclose the complete representation of your store's operation as required by the laws which apply to you.

Many thanks Dr Byte.

Now the BBC is broadcasting 'Action needed' to meet UK's cookie tracking deadline

http://www.bbc.co.uk/news/technology-17745938

And for some of the clients we work with, an audit is already on the cards.

Thanks DrByte for the General information about Zen Cart's very simple use of cookies is already here: http://www.zen-cart.com/content.php?317-cookies

Quote:

'Amid criticism that hardly any UK government websites comply with the new EU-mandated "Cookie Law" that comes into force on 27 May, the ICO has announced that it will be sending out some letters, and then waiting for people to complain.

The ICO will send out 50 letters to the UK's biggest websites over the next few days, its deputy commissioner, David Smith, has announced. At a press conference this morning, Smith said the ICO planned to ask the sites to show that they are asking users' consent for any cookies the websites are using to track their behaviour.

After that, the ICO will wait for users to complain about cookies on particular sites before investigating individual organisations for breaching the data protection law.'

http://www.theregister.co.uk/2012/05/18/cookie_law_ico/

Looking more into the ICO Cookie Legislation, there is an interesting statement from the ICO which say

ico:

Exceptions are likely to be made if the cookie is only being used to ensure a page loads quickly by distributing the workload over several servers, or is employed to track a user as they add goods to a shopping basket.

Based on Zen Cart's very simple use of cookies (outlined at: http://www.zen-cart.com/content.php?317-cookies ) it would be a positive move for the ZC Team to contact ICO (EMAIL: [email protected]) to outline ZC's use of Cookie to get a confirmed response of acceptance or outlined actions

How does that sound?

Should we also be contacting the equivalent organisations in Gemany, France etc, given that they will in all probabliity have a slightly different interpretation to the UK's ICO.

The full ICO guidance is available here. (Note PDF Download)

There is also an interesting take on the regulations here.
In particular category 3, which seems to cover the cookie used in an unmodified Zen Cart store,

And finally a quote from a German IT Blog I was reading the other day.

Either way, if you look at how differently France (even analytics cookies are “necessary”) and the UK (fewer cookies are “necessary”, but implied consent suffices) not so much transposed the Direcitve into national law but interpret their own national laws in light of the Directive, and if you take into account that Germany so far seems to have no idea at all how transpose the Directive at all, the Directive’s ultimate goal – harmonising the law throughout the EU – is very unlikely to be achieved.