On 16 November 2012, the Polish parliament approved the bill on amending the Polish Act of 16 June 2004, the Telecommunications Law, which transposes into Polish law the provisions of the EU Cookies Directive (2009/136/EC).
The directive tightened the existing legislation on cookies, namely the e-Privacy Directive (2002/58/EC), by introducing the obligation to obtain the end-user’s consent to the storing of cookies on their computer, or gaining access to cookies already stored there. Further, the directive requires providing the user, prior to obtaining their consent, with clear and comprehensive information in accordance with Directive 95/46/EC, in particular about the purposes of the processing. There are exceptions if the cookies are absolutely necessary for the provision of a service that has been explicitly requested by the user, or the information storage is for the sole purpose of carrying out online communication.
The implementation of the directive into the national laws of the Member States was required by 25 May 2011. Poland failed to meet this deadline and at the end of May 2012, the European Commission decided to refer Poland, together with five other Member States, to the EU Court of Justice for failing to implement these rules.
The new cookie law in Poland introduces stricter information obligations for online service providers. According to the new law, the user must be informed unambiguously and in an easily understandable manner, about:
- the purpose for storing the cookies, or for gaining of access to those cookies already stored;
- the user’s possibility to determine the conditions of the storage or access to the cookies by modifying the internet browser’s or service’s settings.
The above information should be accessible to the user and their consent must be obtained before the cookies are accessed or placed in the user’s computer. The consent can be expressed by modifying the internet browser’s or the service’s settings in a way which allows for the storage of, or access to cookies.
According to the justification of the bill, extending the information obligation was necessary due to the fact that, at present, products available on the web browsers’ market do not provide the user with the possibility to have full control over the conditions of data processing carried out by online service providers.
Attention must be paid to the provisions of the Polish Act of 8 July 2002 on the provision of electronic services, according to which the service provider is required to provide the user with permanent access to the current information about the function and purpose of any software or data, not being a component of a service, stored on the user’s computer, including cookies.
The new law still needs to be signed by the President of Poland in order to come into force. It is expected that the new law will be binding for online service providers at the beginning of 2013.