In the run-up to Christmas, two interesting opinions were issued by public authorities that address some controversial matters frequently encountered in practice regarding cookies and telemarketing.
On 22 December 2021, the Office for Personal Data Protection issued an opinion in the form of a reply to questions raised about the new legislation on cookies under the amended provision of Sec. 89 (3) of the Act on Electronic Communications (the "Act"). Under the amended provision, a user's consent is required to store data or to gain access to data stored on the user's equipment (with the exception of so-called "strictly necessary cookies").
- Withdrawing/refusing consent should be as easy as giving it. So, merely giving users the option to accept or to manage cookies is insufficient. A third option – "reject all (except strictly necessary cookies)" – is also necessary.
- Storage and access to cookies under Sec. 89(3) of the Act must be differentiated from the processing of data obtained through these cookies. Such processing is governed by the GDPR and, theoretically, there might be other legal reasons for the data processing (e.g. legitimate interest of a data controller). Even in these cases, however, it is necessary to obtain users' consent to store cookies on their devices, and without such consent further processing is banned.
- Pre-ticked consents are not allowed, not even for analytical cookies.
- After having refused to give consent to storing or processing of cookies, the user cannot be prevented from visiting the relevant website.
The new legal regulation on telemarking was also clarified thanks to a joint opinion of the Ministry of Industry and Trade, the Czech Telecommunications Office and the Office for Personal Data Protection, issued on 21 December 2021. The opinion, also in the form of a reply to questions, addressed the amended sections 66, 95 and 96 of the Act on Electronic Communications. Under these new provisions, telemarketers may only use information available in public telephone directories if the users have indicated in the directory that they wish to be contacted for marketing purposes (this is contrary to the previously used "opt-out" principle).
- These provisions apply only to telemarketing carried out using information available in a public telephone directory. The new legislation does not affect the contacting of customers in accordance with Section 7 of Act No. 480/2004 Coll. on Certain Information Society Services or customers and users who have given their explicit consent.
- This legislation does not apply to information published directly by the user, e.g. contact details on company websites. For this information the GDPR or Act No. 480/2004 Coll. applies.
Even a call to obtain a user's consent to telemarketing is considered telemarketing.
By Michal Matejka, Partner, PRK Partners