Before relying on anything in this Blog please read the disclaimer
The Commissioner of Data Protection in Cyprus has announced on the 30th of July 2019 that it received numerous complaints. The subject of the complaints relates to the use of cookies without consent from users.
The accumilation of information or granting of access to already accumilated information is permissible only if the user has granted his consent
Section 99(5) of the Law Regulating Electronic Communications and Mail Services, of 2004( Law 112/2004)
Website Cookie Consent
The announcement of the Data Protection officer goes on to clarify that the consent must be specific, express and received prior to the processing. Such consent must be free and revocable. Guidelines for sufficient consent have been provided in the Working Document 02/2013 providing guidance on obtaining consent for cookies.
Implied or Express Consent
The mear notification of the use of cookies, by the website, does not satisfy the legal requirements of Section 99(5) of the law and only an express consent would satisfy the Cypriot legal requirements.
What are cookies
Cookies are small text files which are saved on the users’ device when they browse the web. More specifically they provide personalized services, for example, the choice of language that the site should be presented and this preference to be stored. Apart from the above cookies are used for the monitoring of user activities.
Subject to, Section 99(5) of the Law Regulating Electronic Communications and Mail Services, of 2004( Law 112/2004) as well as Article 5(3) of EU Directive 2002/58/EC which was amended by 2009/136/EC the storing of cookies requires express consent.
Example of Implied Website Cookie Consent
Example of Express Website Cookie Consent
Actions to take
In order to avoid being examined by the Cypriot data protection officer, it is recommended that you review your current cookie policies. Furthermore, a mechanism should be put in place to ensure that access to your website, i.e. processing of cookies, is undertaken after an express consent has been given by the user.
