The Information Commissioner's Office has published updated guidance for UK website owners on achieving compliance with the amended Privacy and Electronic Communications Regulations 2003 and a report on enforcing the new legal regime on cookies.
The revised Regulations provide that the use of cookies is only allowed if the user concerned has been provided with clear and comprehensive information about the use of cookies and if the user has consented to that use. The ICO's original guidance, published in May 2011, had stated that the ICO would allow a lead-in period of 12 months for organisations to develop ways of meeting the cookie-related requirements of the Regulations before using its enforcement powers.
However, in the report the Information Commissioner expresses disappointment with the level of engagement shown by website owners so far. It stresses that where the ICO receives complaints, website owners must be able to demonstrate the steps they are taking and the timescale within which they expect to achieve compliance.
The practical advice included in the updated guidance is likely to go some way towards making website owners understand the steps they can, and will be expected to take, both with regard to the information they have to provide to users, the way in which it should be provided and the methods available for achieving consent.
