Informing users about cookies is no longer enough
In the current (for a few more weeks still valid) wording of the Electronic Communications Act, you will find the sentence: “Anyone who intends to use or uses electronic communications networks to store data or to access data stored in end devices of participants or users is obliged to inform these participants or users in advance in a demonstrable manner of the scope and purpose of their processing, and is obliged to offer them the option to refuse such processing.” This principle is how the vast majority of Czech websites currently operate, including the largest e-commerce players — information about the use of cookies can be found in inconspicuous banners or website footers.
The amendment to the Act changes this:
“Anyone who intends to use or uses electronic communications networks to store data or to access data stored in end devices of participants or users shall obtain from these participants or users prior demonstrable consent to the scope and purpose of their processing.”
In other words, if you want to meaningfully analyse your website traffic, better target advertising campaigns, or work with visitor and customer data beyond fulfilling a contract, you need to obtain their consent — and without it you are not permitted to do almost anything.
What should such consent look like?
- Above all, it should be functional — if the user does not give consent, you must not set the relevant cookies or share user data with third parties.
- It must be active — you must not have anything pre-checked.
- It must absolutely be freely given — you must not restrict access to the website without consent (e.g. not allowing an order to be placed) or even block entry entirely.
- Giving consent must be equally easy as withholding it — you must not visually suppress or hide the option to decline. In other words, the “Accept” and “Decline” buttons must be at the same level.
- It should comply with the applicable legislation. Within the EU that means GDPR, and if you operate outside the EU you may encounter locally specific requirements.
What does this mean for you?
- Prepare for less data and less precise ad targeting.
- Choose a tool that does most of the work for you. At Proof & Reason, we have come to favour the paid versions of CookieBot. If data forms the backbone of your business, however, more comprehensive solutions may suit you better.
- Use the time before the amendment comes into force to experiment. Consent collection can be designed to feel human, non-intrusive, and easy for visitors to give voluntarily. We would be happy to help you with that.
Telemarketing requires consent too
You may have been surprised by a call from an unknown number at some point. Sometimes it is telemarketing, sometimes an offer of energy services or some product. If you asked the operator where they got your number, they may have answered that it was randomly generated. And it was perfectly legal. The use of phone numbers was subject to a different regime — if you did not want to be bothered by marketing messages, you had to actively opt out through a special database. The amendment to the Electronic Communications Act reverses this completely: unless a call centre has your explicit and demonstrable consent, it is not permitted to dial your number.
How does this affect you?
If you use a phone to reach out to potential contacts, from 1 January you may not do so without the consent of the phone number’s owner. This applies to purchased databases too — if you do not have demonstrable consent from these contacts and you approach them by phone (or indeed by email), you are exposed to the risk of heavy fines from the Office for Personal Data Protection.
There is no need to panic, however. The processing of personal data within the EU has been governed by GDPR since May 2018. You can of course continue calling your existing customers, as well as contacts who have been made aware of your privacy policy and left their phone number when, for example, filling in an enquiry form.
Article by: Jan Kadlec, data analyst
