On 20 May 2013, the Dutch Minister of Economic Affairs, Henk Kamp, published the long-awaited revision of the Dutch cookie regime. As anticipated, the proposal introduces a lighter regime for cookies that are used to measure the "quality and effects" of a website (such as analytic cookies, see our previous article). Further, the explanatory note to the proposal contains a number of considerations on other hot topics such as how to obtain consent, cookie-walls and who should comply with the rules.
It must be emphasised that this proposal is subject to the approval of Parliament, and that the minister has invited stakeholders to comment on the new rules via an internet consultation. Through early involvement with this legislation and the legislative process, our team in The Hague is very well-equipped to safeguard your interests in this consultation.
The proposed changes at a glance
The proposed legislation text is accompanied with an explanatory note. In this note, the Minister takes the opportunity to address a number of issues which have been subject to debate since the introduction of the legislation last June 2012.
Analytics and more
The most significant change to the new text is the introduction of a lighter regime for cookies that i) are used to gather information on the quality and effectiveness of a requested service and ii) have little or no effect on the privacy of the user. If these conditions are met, the standard requirements for cookies (obtaining consent and informing the user) do not apply. Though this exemption mainly applies to analytic cookies in the broadest sense, it could also apply to other uses such as a/b testing of websites.
A lot has been said about the means of obtaining consent in the past legislative history and the publications by the regulators. Nonetheless, the general principal remains unchanged in the new proposal: parties must seek consent for the placement of cookies. The Minister however does make a valuable and pragmatic consideration: if websites inform the user that clicking on any part of the website constitutes consent, the website is allowed to place cookies after the user clicks a link.
The explanatory note also addresses the use of “cookie walls”, which force users to accept all cookies before being able to enter the website. Though the Minister views such implementation as being "undesirable", it is generally allowed under the legislation. The user however must not be dependent on the information or services that he misses if he decides not to accept the cookies presented through the “cookie wall”. In such cases, the consent is not deemed “free” – one of the criteria for consent. Some examples can be found in public services, where not accepting cookies would deprive users from their legal rights (e.g. exporting his current phone number to a new provider) or exercising his legal duty (e.g. completing tax returns).
Who should comply?
In the explanatory note, the Minister finds himself in a difficult position, defending the proposition that websites should comply with the rules, even though they are not always the entity that places the cookies (and therefore the entity that should inform and obtain consent). He argues that such a website has a co-responsibility and can be viewed as an accomplice if the rules are not abided by. Though this may seem like a desirable solution, it is also something that should be addressed in the contractual relationship between websites and third parties.
Not only cookies, not only internet
Something that is often overlooked is the scope of the rules. The rules not only deal with the placement and reading of cookies, but to all information that is placed on and read from the end users' equipment. This means that these rules apply to scripts, information sent through apps and devices, and more. Furthermore, the rules also apply outside the scope of the internet, on media such as Bluetooth, NFC and software such as auto-installers that upload and download information during or after installation.
Where do we go from here?
Industry stakeholders and other parties are invited to share their comments on the proposal until 1st of July via www.internetconsultatie.nl/cookiebepaling. This relatively short consultation period shows that the ministry is determined to resolve the problems regarding the current cookie rules as soon as possible. After the consultation, the proposal will be sent to parliament and the senate. In view of the upcoming parliamentary recess this summer, it seems likely that the new cookie rules will not enter into effect earlier than Q4 this year. It must also be noted that the Dutch parliament has the power to propose amendments to the new cookie legislation. During this legislative process, the regulator (the new "Authority for Consumers and Markets" might be inclined to take a more lenient approach in supervising the soon to be replaced old rules.
If you have any questions, please feel free to get in touch with our data protection experts in The Netherlands:
Berend van der Eijk