Cookies Are To Be Consumed With Moderation Certainly In The Christmas Period

The Belgian data protection authority (BDPA) has published a decision of 17 December 2019 of its litigation chamber in a case that relates entirely to cookies and that may have an impact on the way in which website operators approach cookie consent.

It is a long decision that covers mainly five topics:

The jurisdiction of the BDPA itself and of its litigation chamber in particular, in relation to cookies instead of the telecom sector regulator; The interplay between the concepts and provisions of the General Data Protection Regulation (GDPR) and the rules on cookies; Transparency & information obligations Consent-related obligations Fine & calculation The decision specifically relates to website cookies, but the relevant rules and the findings of the BDPA are technologically neutral. Any reference to «cookies» must therefore also be understood as covering e.g. HTML5 storage and similar technologies. We will not cover the point on jurisdiction because in Luxembourg it is clear that the data protection authority, the CNPD, has powers to enforce the rules on cookies that are contained in the Luxembourg ePrivacy Act of 30 May 2005.

1. Interplay between GDPR & cookie provisions

   Under the GDPR, any processing of personal data must be based on an appropriate legal ground to be permitted, and Article 6 GDPR contains the list of legal grounds (additional requirements apply to the processing of special categories of personal data).

   Under the cookie rules laid down e-Privacy Directive 2002/58/EC, the use of cookies requires consent, unless one of two exemptions applies:

   the «communication» exemption: storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network the «service» exemption: storage or access as strictly necessary in order for the provider of a service (according to the e-Privacy Directive: an «information society service») explicitly requested by the subscriber or user to provide the service In other words, the cookie rules provide for three possible legal grounds (consent and two exemptions), and the GDPR provides for legal grounds that do not always overlap neatly with those «cookie» legal grounds.

   In its decision, the litigation chamber of the BDPA initially appears to suggest that the assessment of legal grounds under the cookie rules replaces the assessment of legal grounds under Art. 6 GDPR, by considering that Art. 5(3) of the ePrivacy Directive (the origin of the...