Companies operating in Ireland have until October 6 to comply with the Irish Data Protection Commission’s (DPC) Guidance Note on the use of cookies.
In April 2020, the Irish Data Protection Commission (DPC) released a report known as the ‘cookie sweep survey’, that examined the cookie policies and practices of 38 unnamed firms operating in Ireland.
In addition to this report, the Irish DPC released new guidelines aimed to ensure that websites use cookies and other tracking technologies to collect personal information from users in accordance with GDPR cookie consent requirements.
It is important to note that other European Data Protection Authorities (DPAs) have recently provided similar guidelines. They are as follows:
Explore more privacy compliance insights and best practices
With the imminent enforcement of the Irish DPC’s guidance on data controllers’ cookie policies and practices, this article will explore:
Overall, cookie classification is based on three key principles:
Purpose
Strictly necessary cookies – also known as essential cookies, this category of cookie is important since it allows you to navigate a website and use its features, such as accessing secure sections of the page.
This subcategory includes cookies that allow e-commerce stores to keep items in your shopping cart while you shop online.
Although both the GDPR and the ePrivacy Directive do not require websites to obtain consent for strictly necessary cookies, users should be made aware of what they are and why they are important.
Preference Cookies – The cookies under this subcategory allow a website to recall the choices you have made previously, such as language preference, the region from which you would like to receive reports, or your login details to allow you to sign in automatically. Preference cookies are also referred to as functionality cookies.
Statistics cookies – These cookies gather information about your website activities, such as the pages you accessed and the links you clicked on.
One important point to remember is that this data cannot be used to identify you. This is because the information has been aggregated, which simply means it has been anonymized.
For this reason, statistics cookies are focused on enhancing website functions. If these cookies are from third-party analytics service providers, the objective of their use remains the same so long as the information they collect is used exclusively by the website owner.
Marketing Cookies – Lastly, promotional cookies record your online activity to assist advertisers deliver more relevant advertising or to limit the number of times you see an ad.
Marketing cookies can share personal data with third-parties or adtech agencies for the purpose of digital marketing.
This type of cookie is persistent and is predominantly of third-party provenance.
Duration
Session Cookies – These are temporary cookies that expire when you close the browser.
Persistent cookies – These are cookies that remain on your device until you either delete them or your browser erases them based on their date of expiration.
Essentially, all persistent cookies have an expiry date written into their code, although the duration may vary.
Provenance
First-party cookies – Primarily, these cookies are stored on your device or computer by the website you visit.
Third-party cookies – These refer to cookies that are placed in your device by a third party, such as an advertiser or an analytics system. In most cases, the website you are visiting does not store them on your device.
Nonetheless, it is essential to note that some cookies may not fit neatly into these categories, while others may qualify for more than one.
The Irish DPC’s guidance note contains regulations governing businesses' cookie policies and practices when collecting personal information from users.
Similar to the CJEU’s Planet 49 Judgement (see the Key Takeaways from the Planet 49 judgement), the Irish Data Protection Commission’s Guidance offers much-needed clarity for businesses regarding the use of cookies and obtaining valid consent from users.
Additionally, it emphasizes the overlap between the GDPR and the ePrivacy Directive in terms of cookie management and user consent.
In May, the EPDB issued guidelines that businesses must follow to be considered to have valid GDPR cookie consent.
Read our blog to learn more EDPB Guidelines on GDPR cookie consent here.
Between August and December 2019, the Irish DPC conducted a compliance review of the websites of 38 data controllers in Ireland, including those in media and publishing, retail, hospitality, insurance, sport and leisure, and the public sector.
This investigation examined how these data controllers comply with both the General Data Protection Regulation (GDPR) and the ePrivacy Directive.
Specifically, the sweep focused on three key aspects:
The Irish DPC used a three-color coding system to assess the level of compliance of data controllers: Red, Green, and Amber. While Green denoted full compliance, Red denoted non-compliance.
Only two of the 38 entities examined received the full 'Green' rating from the Irish DPC.
The following are the main issues that Ireland's Data Protection Commission discovered during its investigation of 38 data controllers operating in the country:
Consent
According to the DPC, businesses must obtain user consent in line with GDPR requirements. This means the consent must be:
However, the guidelines provide two crucial exceptions, which are:
Communications exemption - This exemption applies to cookies used solely to facilitate communication over a network. It does not apply to cookies that help with this kind of transmission.
Strictly necessary exemption - This exception applies to websites or apps that are unquestionably requested by the user. The DPC advises businesses to avoid giving this exclusion a broad interpretation.
Duration of Cookies
The Irish DPC emphasizes that the expiry period of any cookie should be proportional to its purpose.
For example, cookies used to remember what a shopper has in their shopping cart should not be kept indefinitely.
Instead, it should expire once it serves its purpose.
Third-Party Buttons and Widgets
If you allow third parties to add plugins, widgets, pixel trackers, or "like" buttons, you need to be aware of the kind of data shared with these third parties.
The Irish DPC Guidance Note also acknowledges the EU’s Court of Justice’s (CJEU) ruling in the Fashion ID case, which stated that website operators can be considered as joint controllers of personal data collected and shared with third parties.
Similarly, third parties such as payment service providers can potentially serve as processors on the data controller’s behalf.
If you fall under this category, you will be required to have a GDPR-compliant data processing contract with the controller.
As a result, as a data processor, you should adopt measures to better understand your data processing engagements with third parties to identify the obligations and liabilities associated with such relationships.
Analytics Cookies
The Irish DPC requires you to obtain prior and valid GDPR cookie consent from users before placing this category of cookies in their devices .
While first-party analytics cookies are unlikely to raise privacy issues when strictly limited to statistical purposes on your website, third-party analytics cookies are subject for GDPR compliance enforcement actions.
Periodic Updating of Consent
If you maintain records of your consumers’ consent to the installation of cookies on their devices, the Irish DPC guidance note specifies that the period after which their consent should be re-obtained must not exceed six months from the time it was first given.
Similarly, if a user declines to consent to the use of cookies, you may request their consent again after six months.
Systemic Tracking or Profiling
The Irish Data Protection Commission’s guidance note requires you to conduct a GDPR-compliant Data Processing Impact Assessment (DPIA) if you:
To ensure compliance with the Irish DPC Cookie guidance note, you should at least follow the checklist below:
▢ Have a cookie policy that details how cookies are used
▢ Do not “nudge” users to accept cookies through the banner design (for example, make a "reject" button as prominent as an "accept" button)
▢ Do not use pre-ticked boxes or sliders
▢ Do not rely on browsing or scrolling to indicate consent
▢ Avoid bundling cookie consents (i.e., the cookie banner should outline specific purposes for which the cookies are used)
▢ Ensure that consent is reaffirmed within 6 months of the user's initial consent
▢ Conduct a Data Processing Impact Assessment (DPIA) if your use of cookies involve systematic monitoring, tracking, or observation of an individual’s behavior, or if you cross-reference different datasets to profile or analyze user behavior
You can obtain valid cookie consent from users using Secure Privacy's GDPR cookie banner. Our solution helps you to ensure that:
For a personalized demo of our solution, schedule a call with us today and speak with a data privacy expert.
Alternatively, you can activate your free trial of our complete GDPR compliance solution.
Schedule a call to learn more
Irish DPA Official Website
Irish DPA Cookie Guidance Note
Check out the other Cookie Consent Guidelines from other European Data Protection Authorities to see if you need to comply with them too:
Spanish AEPD Cookie Guidelines: The Ultimate Guide
The Belgian Data Protection Authority
Germany’s DSK
French CNIL Consent Guidelines
The Dutch DPA's Cookie Consent Guidelines
Greek DPA Cookie Consent Guidelines:
Our detailed GDPR compliance guide
The ultimate guide to GDPR Cookie Consent Compliance
Czech Cookie Law
