What law forces cookie dialogs on websites? The Web is now covered with poorly designed, intrusive and ineffective dialogs warning about cookies. Presumably this is as a result of an EU directive. Which UK law enacts this directive?
As SJuan76 mentions in a comment, the first cookie-related EU law was: Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws This being an EU Directive, it required transcription into UK law to be valid in the UK. This was effected by: The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 This is a statutory instrument made under the European Communities Act 1972, and came into force on 26 May 2011.
Each directives page on eur-lex has a "national transposition" page. For example, directive 2009/65/EC, concerning UCITS, is available at https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex:32009L0065. There is a navigation box at the top left with several relevant pages: Text Document information Procedure National transposition Summary of legislation (Before the recent site redesign, these were shown as tabs across the top of the page, so for the lack of a better term, I will call these "tabs.") The Document information tab shows, among other metadata, relationships with other EU acts. One useful section on this page is the All consolidated versions section, which is a set of links to consolidated versions of the document, indicated by date. The answer to your question is the National transposition tab, which shows "National transposition measures communicated by the Member States." It is worth noting the disclaimer: The member states bear sole responsibility for all information on this site provided by them on the transposition of EU law into national law. This does not, however, prejudice the results of the verification by the Commission of the completeness and correctness of the transposition of EU law into national law as formally notified to it by the member states. The collection National transposition measures is updated weekly. The list of national acts is in the form of links, which lead to pages that seem designed to present the text of the national legislation, but in the examples I have checked say nothing more than "Text is not available." Perhaps there are some instances, or will be in the future, where these contain links to national legal information sites. As it is, there is enough information to enable one to search the national sites to find the relevant legislation.
Not all cookies require consent. The current answers are in WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194. This WP29 Opinion is based upon Directive 2002/58/EC (&quot;ePrivacy Directive&quot;), and not GDPR, which is current law for this matter until other guidelines are adopted pursuant to GDPR or until the awaited &quot;ePrivacy Regulation&quot; is finally adopted. 1. General rules This Opinion states 2 critera for cookie consent exemption: (...) exempted from the requirement of informed consent, if they satisfy one of the following criteria: CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”. CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”. 2. User preferences The first two types of cookies would be, as I understand, for the purpose of remembering user preference in how it interacts with the Website. Such types of cookies can fall under criterion B, under certain conditions. Section 3.6 &quot;UI customization cookies&quot; explains the conditions that such type of cookies have to meet so that the consent exemption can apply, in particular: User interface customization cookies are used to store a user’s preference regarding a service across web pages and not linked to other persistent identifiers such as a username. They are only set if the user has explicitly requested the service to remember a certain piece of information, for example, by clicking on a button or ticking a box. They may be session cookies or have a lifespan counted in weeks or months, depending on their purpose. (...) These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted (...). The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case If you need to request consent, then WP 29 Working Document 02/2013 providing guidance on obtaining consent for cookies - 1676/13/EN WP 208 contains guidance. 3. Cookie Preference cookie The last type of cookie you mention, being the Cookie Preference cookie, would be, as I understand, only used as a purely technical mean to store and retrieve (transmit) the user's explicit choices preferences, and would most probably fall clearly under criterion A and/or B.
Generally speaking, British courts, when making judgments on constitutional matters regard themselves as interpreting existing law, rather than creating new law. But technically speaking, any legal precedent established by a court can be interpreted as "creation of new law". For the avoidance of doubt, the sources of law in the law of England and Wales include: statute law, constitutional convention, prerogative powers, common law, and legal commentary. I may have missed some out and may edit those in later. Common law refers to the judgments of courts. So here we come to your question: Several legal principles and precedents were established by this judgment, and you may consider this new "law": The court held that prerogative powers are justiciable - courts can limit the scope of these powers The prerogative power in question had limits. It can be limited when its use has an extreme detrimental effect on the democracy of the UK and parliamentary sovereignty. What is important with point one is that the court recognised that this power has always existed, stemming as far back as the bill of rights in the 17th century. As such, the court is implying that it is creating nothing new, but recognising a law that has always existed. You will see a LOT of this when studying constitutional law.
Are UK Tier 4 rules law? Yes. The Health Protection (Coronavirus, Restrictions) (All Tiers) (England) Regulations 2020 (SI 2020/1374) has been amended by SI 2020/1611. Unfortunately, the amendment is only available as pdf at the moment and I can't copy-and-paste it on my phone for you. SI 2020/1374 and all subsequent amendments may be found here... https://www.legislation.gov.uk/primary+secondary?title=Coronavirus%20all%20tiers ETA: The Introductory Text to SI 2020/1374 states: The Secretary of State makes the following Regulations in exercise of the powers conferred by sections 45C(1), (3)(c), (4)(b), (4)(d), 45F(2) and 45P of the Public Health (Control of Disease) Act 1984 https://www.legislation.gov.uk/ukpga/1984/22/contents
Specific laws or regulations relating to metadata are unnecessary, and possibly counter-productive. UK data protection law is centered around the GDPR, which is largely principle-based – instead of providing a checklist of very concrete compliance measures, it is the data controller's responsibility to determine appropriate measures in order to achieve the data protection principles. For example, this obligation is expressed in Art 24 GDPR: Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. […] What risks exist for what activities is extremely contextual. Leaking information through metadata is a potential risk, but it's not a risk in every context. Thus, data controllers should consider whether metadata could pose a privacy problem in their workflows, but they are not necessarily required to redact such metadata. This provision of the UK GDPR is already enforceable, but it would need a case by case analysis to determine whether the risk analysis and selection of technical and organizational measures have been conducted incorrectly. The documents you linked are a HMRC internal manual. These are not normative – they do not bind other organizations. Instead, the existence of these manuals is an expression of HRMC's own obligation to consider various risks and implement appropriate technical and organizational measures (TOMs). Of course, other organizations could use such manuals as a starting point for their own analysis.
See this working paper by Silvia Ferreri for an excellent write-up of this issue. The key point is that because each linguistic version of legislation is equally authentic, none can be taken as the authentic version. The court then resolves this by applying two principles: comparing the linguistic versions and giving deference to legislative intent. This is necessarily a case-by-case analysis. The paper calls attention to Case C‑445/09 arising from the Netherlands, where 9 different linguistic versions are compared and shows that the straightforward Dutch reading of the legislation in question isn't compatible with the other linguistic versions or legislative intent. In paragraph 25, the decision also contains a concise summary of the general principle of interpreting laws in multiple languages: According to settled case-law, the need for uniform application and, accordingly, for uniform interpretation of an EU measure makes it impossible to consider one version of the text in isolation, but requires that it be interpreted on the basis of both the real intention of its author and the aim which the latter seeks to achieve, in the light, in particular, of the versions in all languages (see, inter alia, Case 29/69 Stauder [1969] ECR 419, paragraph 3; Joined Cases C‑261/08 and C‑348/08 Zurita García and Choque Cabrera [2009] ECR I‑10143, paragraph 54; and Case C‑473/08 Eulitz [2010] ECR I‑0000, paragraph 22).
While German law indeed requires providing correct contact information it does not require the recipient to answer queries. It is there so that you can submit legal notifications. In your case I wouldn't be so sure that the information is not correct. However, even if the contact information is incorrect, there is not much you can do about it. This is reserved to the following groups by § 8 Abs. 3 UWG: every competitor; associations with legal personality which exist for the promotion of commercial or of independent professional interests, so far as a considerable number of entrepreneurs belong thereto, and which distribute goods or services of the same or similar type on the same market, provided such associations are actually in a position, particularly in terms of their personnel, material and financial resources, to pursue the tasks, under their memoranda of association, of promoting commercial or independent professional interests, and so far as the contravention affects the interests of their members; qualified entities that prove that they are entered on the list of qualified entities pursuant to section 4 of the Injunctions Act or on the list of the Commission of the European Communities pursuant to Article 4 of Directive 98/27/EC of the European Parliament and of the Council of 19 May 1998 on injunctions for the protection of consumer interests (OJ Number L 166 page 51); Chambers of Industry and Commerce or Craft Chambers. Unless you are a competitor you are out of luck. The hoster or other providers can't do anything and don't need to, as they are not required to check legality of their user's websites. It doesn't really matter where you are by the way for these laws.