DenmarkCookie Order (Cookiebekendtgørelsen), Sections 3 and 4, Information and Consent for Storing or Accessing Information in Terminal Equipment
Bekendtgørelse nr. 1148 af 9. december 2011, § 3-4
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Criminal exposure
- Yes
- Criminal exposure note
- Section 5, paragraph 1 punishes a breach of section 3 with a fine (bøde).
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the end user's consent, after giving full information about the storage or access, before storing information in, or accessing information already stored in, the end user's terminal equipment, or letting a third party do so (section 3, paragraph 1).NIST Privacy FrameworkCT.PO-P1
- Make the information clear, precise and easy to understand, state the purpose, identify every person arranging the storage or access, give immediate access to refuse or withdraw consent with clear guidance on using it, and make the information immediately accessible (section 3, paragraph 2).NIST Privacy FrameworkCM.AW-P1
- Where the storage or access happens through an information and content service, keep the information permanently available through a direct and clearly marked access on that service (section 3, paragraph 2).NIST Privacy FrameworkCM.AW-P1
- You need no consent where the storage or access only carries communication over an electronic communications network or is required to deliver an information society service the end user expressly requested (section 4).
These lines are LexLint's reading of the law's text, as of . Also read by: Erhvervsstyrelsen (guidance, recorded ); C-673/17 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Guidance link
- https://www.retsinformation.dk/eli/retsinfo/2019/10189
- Case citation
- C-673/17
- Guidance body
- Erhvervsstyrelsen
What this law does
Section 3, paragraph 1 of the Cookie Order bars a natural or legal person from storing information in, or gaining access to information already stored in, an end user's terminal equipment, or letting a third party do so, unless the end user consents after receiving full information about the storage or access.
Section 3, paragraph 2 makes the information full only if it is clear, precise and easy to understand, states the purpose, identifies each person arranging the storage or access, gives immediate access to refuse or withdraw consent with clear guidance on using it, and is immediately accessible to the end user.
Section 3, paragraph 2 also requires information on storage or access through an information and content service to be permanently available through a direct and clearly marked access on that service. Section 4, paragraph 1 lifts the ban where the storage or access has the sole purpose of carrying communication over an electronic communications network, or is required to enable the provider of an information society service the end user expressly requested to deliver it.
Section 4, paragraph 2 treats storage or access as required where it is a technical precondition for delivering a service that works in line with its purpose. Section 5, paragraph 1 punishes a breach of section 3 with a fine. The Order takes effect on .
When LexLint raises it
When your app profile says your app tracks devices.