Feeds

Is this the end for Web bugs and dodgy cookies?

Quite possibly, yes

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Today (Wednesday 24 October), the second transitional period of the Data Protection Act takes effect in the UK, meaning that companies are required by law to provide all the personal data they store on anyone, if that person requests it.

This has far-reaching implications for all UK businesses but more significantly (from our perspective anyway) it means all UK Web sites, Web sites with servers based in the UK, and companies that have cookies or Web bugs on UK Web sites will have to review their approach if they are not to fall foul of the new law.

The new laws do have fairly complex repercussions, but only if a site is using the data it has gathered to personally identify visitors. If, as is the case with The Register, any data gathered on the site is used only to build impersonal stats, it is not affected.

There are however two main areas of concern for most Web sites: cookies and email addresses. If a cookie is installed on your machine so a site knows exactly who you are when you visit, the data protection laws come into effect. Also, if visitors are asked to insert personal details such as an email address, name, address etc, that also falls under the new laws.

The security distributor Allasso recently claimed that nine out of ten UK sites collect at least one type of identifying information, and most do so without the visitors' permission, going against the Act.

In essence, if data that can identify you is gathered, a Web site has a legal duty to tell you what exactly is being gathered, what use that will be put to and who will be given access to that information. It will also have to ask you if you are happy with that.

In much of Europe, there is an "opt-in" policy, so a visitor will have to actively click a box to say that information can be used. Legislation going through the EC may soon mean that the UK follows along the same lines and so the Information Commissioner suggests that UK sites adopt the same policy as "best practice". However, legally at the moment, sites need only give you the option, which you need to unclick.

Other main points are:

  • A privacy statement on its own is not enough if you are taking personally identifiable data. People should be made aware if you are taking this data at the time or before you are taking it. The Register's privacy statement is here.
  • Storing IP addresses is not in itself much of a problem because most visitors will be coming in on dynamic addresses (i.e. they will come from a different IP address every time they visit). Static IP addresses are fine unless a site uses that address to link with other data held on someone.
  • Companies have to be careful with data obtained from outside their own sites. Using spiders to gather email addresses is very likely to cross the threshold. If a company buys an email marketing list, it will need to ensure those addresses were obtained legally.
  • Web bugs - if used to gather personally identifiable data - are likely to infringe the Act because, by design, they are not observable to the visitor. This sits badly with the Act assertion that all data be "obtained fairly".
  • In cases where it is possible, Web sites should tell a visitor if they have information on them which they obtained from a third party.
  • Extra care needs to be taken when dealing with kids.
  • The company running a Web site needs to make sure that any personal data stored is secure.
  • Placing personal data on a Web site is not allowed, first because of security but also because it allows that information to be picked up outside the EU. This doesn't apply if that information is already out in the public domain.
  • If a company changes its privacy statement, all data gathered before that point is still subject to the old statement. It a company wants that statement apply to all that it has already, users' consent to that change will need to be sought.
  • Companies that do gather personal data have to, by law, notify the Information Commissioner that they are doing so. This costs £35 a year.
  • If one company takes over another, it will need to take account of how that company's data was gathered before using it under its own privacy statement.


Basically, the best way to view all this is as a tidying up of what has been a very contentious issue for several years. If you don't mind what companies do with the information they pick up from you, there's no problem. If you do, then you have some recourse.

Check out the Data Protection Web site for a lot more information. ®

[This story was first published on Monday 22 October]

Related Links

Data Protection site

Related Stories

The Register's privacy policy
Data Protection Act kicks in

Secure remote control for conventional and virtual desktops

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
No, thank you. I will not code for the Caliphate
Some assignments, even the Bongster decline must
Kaspersky backpedals on 'done nothing wrong, nothing to fear' blather
Founder (and internet passport fan) now says privacy is precious
TROLL SLAYER Google grabs $1.3 MEEELLION in patent counter-suit
Chocolate Factory hits back at firm for suing customers
Mozilla's 'Tiles' ads debut in new Firefox nightlies
You can try turning them off and on again
Facebook, Google and Instagram 'worse than drugs' says Miley Cyrus
Italian boffins agree with popette's theory that haters are the real wrecking balls
Sit tight, fanbois. Apple's '$400' wearable release slips into early 2015
Sources: time to put in plenty of clock-watching for' iWatch
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.