EU's 27 Countries Have 27 Interpretations of New Privacy Law
There are 27 countries in the European Union -- and 27 different interpretations of Europe's new e-privacy rules.
To make it even more complicated, the e-privacy law has been issued as a directive, a form of legislation that lets every E.U. country fashion its own domestic law, as long as they honor the spirit of the directive.
The result is that Europe's internet privacy regulations are a quagmire, aggravated by the E.U. taking a hard line with cookies by requiring opt-in consent for every website, making it difficult to put the new rules into practice.
The E.U. directive on online privacy was supposed to become law in each country by May 2011, but in February 2012 that 's only happened in 11 of the 27 countries. Some of the biggest, like Germany, Spain, and Italy, are still missing. (Luxembourg, however, is in!)
The U.K. and France have taken a pragmatic approach, interpreting consent if consumers don't opt out, even if that isn't exactly what the E.U. directive says. In the Netherlands, however, a populist right-wing party is pushing very restrictive rules that are likely to pass on March 6, and Germany is likely to be similarly hard line in its approach.
Stephan Loerke, managing director of the World Federation of Advertisers, said, "The E.U. directive calls for a specific opt-in approach, but this is unworkable and it undermines ad-funded content."
The fundamental question is whether the placement of a cookie requires consent. Consumers need to feel their online privacy is respected, but a smooth user experience is also important. Nobody wants to be interrupted by constant requests for consent.
Jim Halpert, co-chair of data privacy practice at U.S. law firm DLA Piper, said, "This is a crystal-clear example of why a fragmentary approach doesn't work for situations where one site interacts with people across borders. The goal has to be to make something as simple as possible. Europe is crying out for a single set of rules, and in the long term, we hope there will be one global tracking control solution."
So European media and marketing industries are turning to self-regulation with an icon system, modeled on the U.S. Advertising Options Icon. It's being tested on a few sites now, and is due to launch in Europe this summer.
Supporters, who include the Internet Advertising Bureau, the WFA, and various agency networks and media owners, hope that the E.U. -- in particular a group called Article 29 made up of data protection officers from each country -- will embrace the initiative.
"It's very unsatisfactory," Mr. Loerke said. "We don't have a clear solution so we are trying to go ahead with our own solution."
Industry groups are banking on the E.U. accepting the icon system, which offers an easy click-through service for users who want to know more about privacy policies and make an informed choice about consent.
The media and marketing industry doesn't believe opt-in consent is necessary, and hopes it can demonstrate that an opt-out approach is enough to protect the privacy of E.U. citizens. But the Article 29 group is a difficult, fractious body to deal with, riven with factions based on different industries and geographical regions.
Oliver Gertz, managing director of WPP Group's MediaCom Interaction E.M.E.A., said, "Our hope is that we can get agreement for this industry-wide solution, otherwise it will be extremely confusing for the consumer if there are different methods and approaches in every country. If we make opting-out easier and more transparent, consumers will feel confident and safe. The fact that no one is imposing the law shows that the policy makers understand they could destroy something valuable, so they are moving toward the consent model."
One problem, Mr. Gertz said, is that cookies have wrongly become synonymous with personal data. "We don't want to collect personal information in cookies. We want to know if you belong to a group of young mothers or retired people, but even then we don't want to store that information."
In Germany, where Group M's Mr. Gertz is based, consumers are more concerned about privacy than in most E.U. countries. So Group M's privacy-planning policy has been to create systems that will satisfy German consumers in the belief that if the Germans are happy, other Europeans will be too.
"A big cloud is on the horizon," he said. "We don't know if it will bring a welcome summer storm or a thunderstorm that destroys everything."