ePrivacy Directive

Subscribe to ePrivacy Directive via RSS
Digital shield 3D rendering stock photo.

The draft guidelines provide further clarification to the EDPB’s interpretation of legitimate interests, and suggest a potential divergence with the UK ICO.

By Gail Crawford, Fiona Maclean, Myria Saarinen, Tim Wybitul, Alice Brunning, and Calum Docherty

On 8 October 2024, the European Data Protection Board (EDPB) released draft Guidelines 1/2024 (the Guidelines) setting out its approach to processing personal data based on the “legitimate interests” legal basis in Article 6(1)(f) of the GDPR. The Guidelines…

The privacy organisation noyb will file more than 10,000 complaints for use of cookies contrary to its interpretation of compliance.

By Gail Crawford, Myria Saarinen, Tim Wybitul, Wolf Boehm, Charlotte Guerin, and Amy Smyth

On 31 May 2021, the nonprofit privacy organisation noyb (short for “none of your business”) launched a large-scale campaign to combat allegedly unlawful cookie banners and practices. According to a press release, noyb has already sent draft complaints to the operators of more than 500 frequently visited websites, and is intending to send a further 10,000 complaints this year. This is space where website operators arguably have considerable room for interpretation and to develop a variety of approaches for providing cookie information and obtaining cookie consent. Noyb’s campaign seeks to impose its interpretation of applicable cookie rules across the EU through threats of complaints to supervisory authorities.

Affected companies that fail to bring their cookie practices into compliance with noyb’s interpretation of the legal requirements will face complaints brought by noyb to the competent data protection supervisory authorities.

The French data protection authority’s decisions cite violations of the cookie rules under the ePrivacy Directive and provide important insights on explicit consent.

By Gail Crawford, Myria Saarinen, Tim Wybitul, and Wolf-Tassilo Böhm

Between December 2019 and May 2020, the French data protection authority (CNIL) conducted multiple online investigations by visiting google.fr and amazon.fr, before launching a full-scale investigation into Google LLC, Google Ireland, and Amazon Europe Core. On 7 December 2020, the CNIL handed down two decisions, one against Google LLC (€60 million fine) and Google Ireland (€40 million fine), and another against Amazon Europe Core (€35 million fine). Contrary to a previous sanction against Google LLC, which was triggered by specific complaints about its practices, the CNIL’s decisions indicate that the investigations were launched sua sponte with the specific aim of controlling the companies’ cookie practices.