Feeds

Is this the end for Web bugs and dodgy cookies?

Quite possibly, yes

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Today (Wednesday 24 October), the second transitional period of the Data Protection Act takes effect in the UK, meaning that companies are required by law to provide all the personal data they store on anyone, if that person requests it.

This has far-reaching implications for all UK businesses but more significantly (from our perspective anyway) it means all UK Web sites, Web sites with servers based in the UK, and companies that have cookies or Web bugs on UK Web sites will have to review their approach if they are not to fall foul of the new law.

The new laws do have fairly complex repercussions, but only if a site is using the data it has gathered to personally identify visitors. If, as is the case with The Register, any data gathered on the site is used only to build impersonal stats, it is not affected.

There are however two main areas of concern for most Web sites: cookies and email addresses. If a cookie is installed on your machine so a site knows exactly who you are when you visit, the data protection laws come into effect. Also, if visitors are asked to insert personal details such as an email address, name, address etc, that also falls under the new laws.

The security distributor Allasso recently claimed that nine out of ten UK sites collect at least one type of identifying information, and most do so without the visitors' permission, going against the Act.

In essence, if data that can identify you is gathered, a Web site has a legal duty to tell you what exactly is being gathered, what use that will be put to and who will be given access to that information. It will also have to ask you if you are happy with that.

In much of Europe, there is an "opt-in" policy, so a visitor will have to actively click a box to say that information can be used. Legislation going through the EC may soon mean that the UK follows along the same lines and so the Information Commissioner suggests that UK sites adopt the same policy as "best practice". However, legally at the moment, sites need only give you the option, which you need to unclick.

Other main points are:

  • A privacy statement on its own is not enough if you are taking personally identifiable data. People should be made aware if you are taking this data at the time or before you are taking it. The Register's privacy statement is here.
  • Storing IP addresses is not in itself much of a problem because most visitors will be coming in on dynamic addresses (i.e. they will come from a different IP address every time they visit). Static IP addresses are fine unless a site uses that address to link with other data held on someone.
  • Companies have to be careful with data obtained from outside their own sites. Using spiders to gather email addresses is very likely to cross the threshold. If a company buys an email marketing list, it will need to ensure those addresses were obtained legally.
  • Web bugs - if used to gather personally identifiable data - are likely to infringe the Act because, by design, they are not observable to the visitor. This sits badly with the Act assertion that all data be "obtained fairly".
  • In cases where it is possible, Web sites should tell a visitor if they have information on them which they obtained from a third party.
  • Extra care needs to be taken when dealing with kids.
  • The company running a Web site needs to make sure that any personal data stored is secure.
  • Placing personal data on a Web site is not allowed, first because of security but also because it allows that information to be picked up outside the EU. This doesn't apply if that information is already out in the public domain.
  • If a company changes its privacy statement, all data gathered before that point is still subject to the old statement. It a company wants that statement apply to all that it has already, users' consent to that change will need to be sought.
  • Companies that do gather personal data have to, by law, notify the Information Commissioner that they are doing so. This costs £35 a year.
  • If one company takes over another, it will need to take account of how that company's data was gathered before using it under its own privacy statement.


Basically, the best way to view all this is as a tidying up of what has been a very contentious issue for several years. If you don't mind what companies do with the information they pick up from you, there's no problem. If you do, then you have some recourse.

Check out the Data Protection Web site for a lot more information. ®

[This story was first published on Monday 22 October]

Related Links

Data Protection site

Related Stories

The Register's privacy policy
Data Protection Act kicks in

Choosing a cloud hosting partner with confidence

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.