Online Ad Code Not in Compliance with European Data Protection Laws: Working Party

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Self-regulatory standards for online behavioral marketing adopted in April 2011 by two major European industry associations are not adequate to ensure compliance with current European data protection laws, according to the Article 29 Data Protection Working Party.

The Working Party—an independent advisory body consisting of representatives from the data protection authorities of European Union member states—has issued an opinion assessing the Best Practice Recommendation on online behavioral advertising adopted by the European Advertising Standards Alliance (EASA) and the Internet Advertising Bureau Europe (IAB).

Notice of Behavioral Advertising

The EASA/IAB’s proposed framework recommends that websites use a particular icon to provide notice of behavioral advertising practices. The icon would be linked to an informational website at www.youronlinechoices.eu. On this site, users would be able to opt out of behavioral advertising by selecting specific company names from a list of advertising networks.

In the Working Party’s view, this approach does not properly inform website visitors about the use of cookies, as required by the e-Privacy Directive. Average web users would not be able to recognize the icon’s meaning without any additional description, the Working Party said. The icon should be accompanied by other forms of notice, which would include information as to what types of information are being collected and by whom.

Consent to Cookies

In addition, the Working Party noted, the e-Privacy Directive requires that consent be obtained before cookies are placed on users’ computers or information stored on the users’ computers is collected. The EASA/IAB framework, instead of seeking prior consent, was said to provide a way for users to exercise “choice”—which amounted to opting out of further data collection. This “choice” did not meet the requirements of the directive, the Working Party said.

The Working Party also expressed concern that the EASA/IAB self-regulatory code did not contain provisions on the amount of data collected and the period of time the data would be retained.

Tracking Web Surfing

Moreover, the EASA/IAB standards and website created an incorrect impression that it was possible to choose not to be tracked while surfing the web, the Working Party said. This misapprehension could be damaging to users, as well as to the advertising industry, if advertisers are led to believe that by applying the code they meet the requirements of the e-Privacy Directive.

Full text of the Working Party’s Opinion 16/2011 on EASA/IAB Best Practice Recommendation on Online Behavoural Advertising appears at CCH Privacy Law in Marketing ¶60,710 and here on the European Commission’s website.

California Bill Would Allow Consumers to Opt Out of Online Tracking

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

California consumers would have the opportunity to opt out of online tracking, under the provisions of a proposed bill under consideration in the California Senate.

Senate Bill 761 would call on the Attorney General, in consultation with the California Office of Privacy Protection, to adopt regulations requiring persons or entities doing business in California to provide California consumers with a method to opt out of the collection, use, and storage of their personal information.

Entities would also be required to disclose how they use consumers’ information and to which third parties they transfer the information.

Covered Information

Information covered by the bill would include the online activity of an individual and other personal identifying information, including postal addresses, e-mail addresses, telephone or fax numbers, and government-issued identification numbers.

The measure would not cover business addresses, telephone numbers, or fax numbers, or any information collected from or about an employee by an employer, prospective employer, or former employer that directly relates to the employee-employer relationship.

Exemptions

The measure would exempt persons or entities that:

(1) Store information about fewer than 15,000 individuals;

(2) Collect information from fewer than 10,000;

(3) Do not collect or store sensitive information; and

(4) Do not engage in monitoring or analysis of consumer behavior as the person’s or entity’s primary business.

Civil Action for Damages

The bill would make a covered entity that willfully fails to comply with the regulations liable to an affected consumer in a civil action for damages between $100 and $1,000, as well as punitive damages in the court’s discretion.

Originally introduced February 18 as an amendment to California’s coupon law (Business and Professions Code Sec. 17701), the bill was amended on March 24 by its author, Senator Alan S. Lowenthal, to substitute text regulating online tracking.

On April 4, the bill was amended to limit the exemption from coverage to entities that meet all of the four conditions listed above, rather than any one of them.