Is it time for a comprehensive review of the use of cookies?

In light of the Belgian Data Protection Authority’s findings regarding irregularities in the data subjects’ consent procedure used by a prominent advertising agency, data protection professionals and stakeholders anticipate to observe novelties which may be introduced in the field of management of preferences for advertising purposes and data subjects’ consent. It is thus beyond doubt that any such key takeaways would fall within scope of the data protection principles of transparency and accountability, as well as the informed consent regime.

Ahead of another landmark judgement on data protection and privacy issues, we are also witnessing a Leading Supervisory Authority sharing the draft decision expected to be issued with the Supervisory Authorities of the Member States for further consideration; the consistency and cooperation mechanism (laid down in Art.63 of the GDPR) is thus triggered. It goes without saying that the European Commission is expected to play a decisive role in adopting a final decision in case the supervisory authorities of the Member States do not come to an agreement.

With regard to cookies practices in Greece, the Hellenic Data Protection Authority (DHPA) issued a guidance document back in 2020 with specific compliance recommendations on obtaining valid consent. In this context, inter alia, HDPA suggested that information on cookies categories should be provided to users through different levels, ensuring that the users’ consent is obtained after they have been explicitly informed about the processing purpose, the recipients and the storage period of personal data collected.