I am developing a web application that is only being used internally in a company (inside EU), and it is only for the employees.
Do I have to show a message to the users that my application is using cookies?
-
Do you even use any cookies that would require you to ask for consent? Not all cookies do.– jcaronSep 1, 2016 at 16:19
-
Here is my opinion, although lazy users may not like it: No, you don't have to show a message, even on live sites facing the public. Just put it in the terms: "We do blah. By using this site you agree to blah, otherwise you must leave and forfeit rights to blah us" It's no different than a popup since, technically, every user must read and agree to the terms in order to use your site(s). Popups are also a paradox since often, cookies are already dropped before a user (or suer) clicks "I consent". For example, how many of you actually conditionally load analytics after a consent click? About 0.– dhaupinSep 1, 2016 at 20:52
-
@jcaron for now, I have a "remember me" function to keep the user logged in even if the session is over– behzadSep 2, 2016 at 8:48
-
@dhaupin that sounds like a simple solution, but first i will ask the HR, if something like this is already in everybody's contract– behzadSep 2, 2016 at 8:49
Add a comment
|
1 Answer
This guidance (Guidance on the rules on use of cookies and similar technologies) from ICO(UK's independent body set up to uphold information rights) has a part related to the intranet:
How do these rules apply to intranets? In our view the rules do not apply in the same way to intranets. The Regulations require that consent is obtained from the user or subscriber. A ‘user’ is defined as any individual using a public electronic communications service. An intranet is unlikely to be a public electronic communications service. Although the Regulations would not therefore apply in the same way to cookies that are set on an intranet it is important to remember that the requirements of the DPA are likely to apply if your use of cookies is for the purposes of monitoring performance at work, for example. Wherever an organisation collects personally identifiable information using cookies then the normal fairness requirements of the DPA will apply.
-
1To amend this: Despite claims to the contrary there is no such thing as a Cookie law, there is a [privacy directive] (eur-lex.europa.eu/LexUriServ/…) (that covers, but is not limited to cookies). The point of the privacy directive is to get the users "informed consent" that their data is tracked. So if you have previously acquired the informed consent, e.g. as part of the employment contract, or because your users have accepted terms of use when they sign up for intranet access then there is no point in getting extra permission for cookies. Sep 1, 2016 at 14:07
-
That reference seems a bit hazy: "We don't think the regulations apply to an intranet unless you are using cookies in such a way that they would apply." Sep 1, 2016 at 20:10
-
@eike Your comment sounds like a great answer to this question on its own. Also, it sounds like you would recommend that we change our tag from eu-cookie-law to eu-privacy-directive, correct? Sep 1, 2016 at 20:12
-
1@StephenOstermiller, as to your first comment: this guidance refers to two different sources, so the meaning is: even if the EU privacy directive does no apply the DPA (the British Data Protection Act) might. So in context this is not particularly hazy. As for the second comment, the EU does not have even have the authority to pass laws (at least not directly - the EU parliament adopts directives that need to be transformed into national laws by the member states), so yes, a tag that says "EU law" should indeed by renamed. Sep 2, 2016 at 7:13