IrelandIrish ePrivacy Regulations
Officially S.I. No. 336 of 2011, Storage of and Access to Information on Terminal Equipment
Also known as Irish Cookie Regulations.
S.I. No. 336 of 2011, reg. 5(3)-(5)
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
What it requires
- Obtain the user's or subscriber's consent, after giving them clear and comprehensive information, prominently displayed and easily accessible, about the purposes of the processing, before storing information on their device or accessing information already stored there (cookies, local storage, or a comparable technique).
- You may obtain that consent through browser settings or another technological application, where doing so is technically possible and effective.
- You do not need consent for storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or strictly necessary to provide an information society service the user explicitly requested.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Criminal exposure note
Regulation 5 creates no offence of its own. Regulation 17(10) makes it an offence to fail to comply with an enforcement notice the Data Protection Commission serves, a class A fine under regulation 27(1); that offence is for ignoring the notice, not for the regulation 5 breach.
Who enforces it
Enforcement body
Data Protection Commission, which may investigate a complaint or act on its own initiative and serve an enforcement notice; regulation 5 is not among the regulations the Commission for Communications Regulation monitors under regulation 30.
Settledness
- As of
- Guidance link
- https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf
- Guidance body
- Data Protection Commission
- Open questions
- Does a cookie that detects fraud or secures a login session meet the exemption in Regulation 5(5) of S.I. No. 336 of 2011 for storage 'strictly necessary' to provide a service the user explicitly requested, when the Data Protection Commission's guidance gives shopping-basket and language-preference cookies as examples and does not mention security uses?
What this law does
Regulation 5(3) bars using an electronic communications network to store information, or gain access to information already stored, in a subscriber's or user's terminal equipment, unless the subscriber or user has consented and has first been given clear and comprehensive information, prominently displayed and easily accessible, about the purposes of the processing, in accordance with the Data Protection Acts.
Regulation 5(4) lets that consent be given, where technically possible and effective, through browser settings or another technological application. Regulation 5(5) exempts storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or strictly necessary to provide an information society service the subscriber or user explicitly requested.
A breach of regulation 5 is not itself an offence: the Data Protection Commission instead investigates and may serve an enforcement notice, and only a failure to comply with that notice is an offence.
When LexLint raises it
When your app profile says your app tracks devices.
Back to the example · Lint your app
Page updated .