Netherlands

[NL] Dutch public service broadcaster sanctioned for violating cookie-rules

IRIS 2014-8:1/33

Anne Goubitz

Institute for Information Law (IViR), University of Amsterdam

The Autoriteit Consument en Markt (ACM), the Dutch authority for consumers and the market, decided on 15 July 2014 that the Dutch Broadcasting Organisation NPO (Nederlandse Publieke Omroep) has violated the cookie-rules of Article 11.7a of the Telecommunicatiewet (Dutch Telecom Act). The enforcement of the cookie-rules is of special interest for governmental websites such as the NPO, considering their role model function in complying with the law.

The NPO uses, amongst others, analytical cookies and tracking cookies on their websites in order to comply with the Mediawet (Dutch Media Act). Since September 2012, the ACM had been in contact with the NPO for violating the cookie-rules of Article 11.7a of the Dutch Telecom Act. According to this cookie-provision there is a duty to inform users clearly and completely about the purpose of placing cookies on their devices. After being informed, the user must give permission for the placing of the cookies on their devices.

The ACM cooperated with the College Bescherming Persoonsgegevens (CBP), the Dutch Data Protection Authority, in interpreting the provisions of the cookie-rules. The websites of NPO first contained a cookiewall, whereby users can only enter the website after agreeing with the terms of the cookiewall. The CBP held that the use of a cookiewall by a publicly-funded website of the NPO deprives users from making a free choice in entering the website, considering the lack of equal or alternative websites.

As a result of the conversations between the ACM and the NPO on complying with the cookie-rules, the NPO made adjustments to the use of cookies on their websites by replacing the cookiewall with a cookiebanner. A cookiebanner provides users with information about the use of cookies, and at the same time provides access to the website of the NPO. The ACM, however, found that the websites of the NPO were still not in accordance with the provisions of the Dutch Telecom Act due to the fact that permission of the users is implied as they enter the website without the users having to give explicit permission.

The ACM held that the NPO was in violation of the cookie provisions of Article 11.7a of the Dutch Telecom Act by not sufficiently informing the users of their websites and by not asking explicit permission for placing cookies on users devices. According to the ACM, several websites such as www.uitzendinggemist.nl and www.npo.nl lack information on what personal data can be collected and the purposes for collecting personal data. Due to the inadequate informing of the users of NPO’s websites, the users are unaware of what they are giving permission for.

The user’s permission must be given freely and must be specific and informed according to the Dutch Telecom Act. The permission must be given explicitly as an opt-in from an action such as clicking on the website. No permission can be obtained by the NPO from a user through simply surfing on the website, therefore the cookiebanner system used by the NPO was found not to be in conformity with an active act of giving permission. The ACM has imposed an order for periodic penalty payments on the NPO (EUR 20,000 per week).