Before relying on anything in this Blog please read the disclaimer 

The Commissioner of Data Protection in Cyprus has announced on the 30th of July 2019 that it received numerous complaints. The subject of the complaints relates to the use of cookies without consent from users.

The accumilation of information or granting of access to already accumilated information is permissible only if the user has granted his consent

Section 99(5) of the Law Regulating Electronic Communications and Mail Services, of 2004( Law 112/2004)

Website Cookie Consent

The announcement of the Data Protection officer goes on to clarify that the consent must be specific, express and received prior to the processing. Such consent must be free and revocable. Guidelines for sufficient consent have been provided in the Working Document 02/2013 providing guidance on obtaining consent for cookies.

Implied or Express Consent

The mear notification of the use of cookies, by the website, does not satisfy the legal requirements of Section 99(5) of the law and only an express consent would satisfy the Cypriot legal requirements.

What are cookies

Cookies are small text files which are saved on the users’ device when they browse the web. More specifically they provide personalized services, for example, the choice of language that the site should be presented and this preference to be stored. Apart from the above cookies are used for the monitoring of user activities.

Subject to, Section 99(5) of the Law Regulating Electronic Communications and Mail Services, of 2004( Law 112/2004) as well as Article 5(3) of EU Directive 2002/58/EC which was amended by 2009/136/EC the storing of cookies requires express consent.

Example of Implied Website Cookie Consent

Example of implied consent -  New York Times - of a good cookie consent
New York Times has a great consent to cookie use however it is an implied consent

Example of Express Website Cookie Consent

Example of an express consent for the use of cookies
Example of Express Consent for the use of Cookies – The Cyprus Lawyer. In this express consent the entire website fades and is locked. The user may exit the website, or provide consent (ACCEPT). Such a form of consent is compliant with Section 99(5) of the Law regulating Electronic Communication in Cyprus.

Actions to take

In order to avoid being examined by the Cypriot data protection officer, it is recommended that you review your current cookie policies. Furthermore, a mechanism should be put in place to ensure that access to your website, i.e. processing of cookies, is undertaken after an express consent has been given by the user.

Blue painted hands impressed in the dark limassol stones
Remember me – Picture by Nicola Evans