Changes in the processing of cookies from the point of view of the new law on electronic communications
The changes take place from 01.02.2022.
Cookies
What are cookies?
Cookies can be characterized as a text file that is stored on the terminal device (computer or mobile device) of the website visitor. The file is stored locally when you visit the website. Cookies also allow us to analyze the use of our website. It must not include any personal data and it is not possible to identify you through them on third-party websites – including the pages of analysis providers. Consent is required.
What cookies do we use based on various criteria:
We only use necessary cookies that enable the proper functioning of our website.
We divide them into:
- the so-called temporary (session) cookies (they are automatically deleted after closing the web browser)
- the so-called persistent cookies (remain stored on the disk even after closing the web browser)
- the so-called third-party cookies that are created by a person other than the website operator
- the so-called first party cookies (first party cookies) – used for web-site analytics (statistical evaluation of website traffic
Such data processing takes place in accordance with §55 par. 5 of Act no. 351/2011 Coll. on electronic communications (the law is valid until January 31, 2021). From February 1, 2022, the new Act 452/2021 Coll. on electronic communications. Where § 109 par. 8 imposes the obligation to have demonstrable consent to obtain information from the terminal device of the website visitor.
Consent according to Art. 6 par. 1. letter a) The Regulation is necessary for the processing of cookies in the following cases:
- which serve for the technical storage of data or access to them;
- the purpose of which is to transmit or facilitate the transmission of a message via a network;
- which are necessary for the information society service provider to provide the information society service explicitly requested by the user
- must store proof of the visitor’s consent to the selected group of cookies
It is possible to use cookies (e.g. statistical cookies) without the consent of the website visitor. technical cookies must be executed constantly, otherwise the website would not work (chat window), therefore the operator does not need consent for them. Technical cookies include tracking the number of site visitors without their further identification..
The person concerned has the right to withdraw consent to the processing of personal data concerning him at any time. The affected person can revoke the consent in the same way as the consent was granted. Consent will not be considered freely granted if the person concerned does not have the option of freely choosing to grant consent. Consent cannot be pre-defined, it must be actively granted by oneself. We do not recommend collecting other cookies based on the so-called legitimate interest of the operator.
The cookies bar is not necessary if the website does not process any data.
General rules for the use of cookies:
Step no. 1:
- It is necessary for the operator to review the website, e.g. what cookies it processes, what it uses them for, and at the same time for what purpose it uses them
- During the analysis of the use of cookies on a given website, we recommend evaluating the necessity and benefits of individual types of cookies. A simple rule applies, according to which, if the operator does not even need certain cookies, it is more appropriate to completely remove them from the given website
Step no. 2:
It is necessary to create a cookies bar on the website, which should contain:
- Close the cookies bar with a cross
- It should not block the browsing of the website
- When visiting the website, the cookie bar should not bother the website visitor
- The visitor should accept cookies or reject cookies at the first option
- The website administrator (IT technician) can create his own cookie bar or purchase a ready-made software solution
- The possibility to go to the cookie settings and choose which cookies are yes/which are not, if we provide cookies to third parties, e.g. Facebook (the Facebook pixel is used), it is necessary to obtain consents not only for the given purposes, but also for third parties
- The website visitor must be able to go back and change the consent granted for the use of cookies at any time (the website visitor can change the decision in the browser settings)
- In case of effective revocation of consent to the processing of a category of cookies, it is necessary to immediately stop the processing of these cookies. The granted consent must be revoked at any time and its revocation should be as simple as obtaining it – i.e. j. if 1 click is set to obtain consent, the same number of clicks must also be set to withdraw consent
- In case of any changes in the processing of personal data through cookies, it is necessary to request consent for processing again
- The operator must have webo on the first layer of the cookie bar
on the page buttons (A) “MANAGE OPTIONS” x “ACCEPT ALL” x “REJECT ALL”; - If the website is managed by, or personal data is processed by an external company/entrepreneur, it is necessary to have an intermediary contract concluded with this entity.
Step no. 3:
Information obligation in terms of GDPR:
- what cookies will be processed on the operator’s website
- what is the purpose of the processing
- legal basis
- processing time (we recommend minimizing processing) is a maximum of 13 months from the date of the last visit
- recipients
- contact details of the operator
- the rights of the person concerned
Conclusion:
- The Office for the Regulation of Electronic Communications and Postal Services may a legal or natural person (entrepreneur) who violates § 109 of Act 452/2021 Coll. a fine from 200 euros to 10% of the turnover according to paragraph 6 for the previous accounting period in accordance with § 124 par. 1 of this Act.
- The Office for the Protection of Personal Data can impose a fine for non-fulfillment of the obligation related to the regulation of cookies (especially with the granting of consent to the processing of cookies and transparent information about the processing of cookies) up to 20,000,000 euros or 4% of the total annual turnover of the group.