Feeds

Is Wednesday the end for Web bugs and dodgy cookies?

Quite possibly, yes

  • alert
  • submit to reddit

SANS - Survey on application security programs

This Wednesday (24 October), the second transitional period of the Data Protection Act takes effect in the UK, meaning that companies are required by law to provide all the personal data they store on anyone, if that person requests it.

This has far-reaching implications for all UK businesses but more significantly (from our perspective anyway) it means all UK Web sites, Web sites with servers based in the UK, and companies that have cookies or Web bugs on UK Web sites will have to review their approach if they are not to fall foul of the new law.

The new laws do have fairly complex repercussions, but only if a site is using the data it has gathered to personally identify visitors. If, as is the case with The Register, any data gathered on the site is used only to build impersonal stats, it is not affected.

There are however two main areas of concern for most Web sites: cookies and email addresses. If a cookie is installed on your machine so a site knows exactly who you are when you visit, the data protection laws come into effect. Also, if visitors are asked to insert personal details such as an email address, name, address etc, that also falls under the new laws.

The security distributor Allasso recently claimed that nine out of ten UK sites collect at least one type of identifying information, and most do so without the visitors' permission, going against the Act.

In essence, if data that can identify you is gathered, a Web site has a legal duty to tell you what exactly is being gathered, what use that will be put to and who will be given access to that information. It will also have to ask you if you are happy with that.

In much of Europe, there is an "opt-in" policy, so a visitor will have to actively click a box to say that information can be used. Legislation going through the EC may soon mean that the UK follows along the same lines and so the Information Commissioner suggests that UK sites adopt the same policy as "best practice". However, legally at the moment, sites need only give you the option, which you need to unclick.

Other main points are:

  • A privacy statement on its own is not enough if you are taking personally identifiable data. People should be made aware if you are taking this data at the time or before you are taking it. The Register's privacy statement is here.
  • Storing IP addresses is not in itself much of a problem because most visitors will be coming in on dynamic addresses (i.e. they will come from a different IP address every time they visit). Static IP addresses are fine unless a site uses that address to link with other data held on someone.
  • Companies have to be careful with data obtained from outside their own sites. Using spiders to gather email addresses is very likely to cross the threshold. If a company buys an email marketing list, it will need to ensure those addresses were obtained legally.
  • Web bugs - if used to gather personally identifiable data - are likely to infringe the Act because, by design, they are not observable to the visitor. This sits badly with the Act assertion that all data be "obtained fairly".
  • In cases where it is possible, Web sites should tell a visitor if they have information on them which they obtained from a third party.
  • Extra care needs to be taken when dealing with kids.
  • The company running a Web site needs to make sure that any personal data stored is secure.
  • Placing personal data on a Web site is not allowed, first because of security but also because it allows that information to be picked up outside the EU. This doesn't apply if that information is already out in the public domain.
  • If a company changes its privacy statement, all data gathered before that point is still subject to the old statement. It a company wants that statement apply to all that it has already, users' consent to that change will need to be sought.
  • Companies that do gather personal data have to, by law, notify the Information Commissioner that they are doing so. This costs £35 a year.
  • If one company takes over another, it will need to take account of how that company's data was gathered before using it under its own privacy statement.


Basically, the best way to view all this is as a tidying up of what has been a very contentious issue for several years. If you don't mind what companies do with the information they pick up from you, there's no problem. If you do, then you have some recourse.

Check out the Data Protection Web site for a lot more information. ®

Related Links

Data Protection site

Related Stories

The Register's privacy policy
Data Protection Act kicks in on Wednesday

3 Big data security analytics techniques

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Number crunching suggests Yahoo! US is worth less than nothing
China and Japan holdings worth more than entire company
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.