Update on Data Protection in Europe

TAAN 2002 Summer Meeting
The Park Hotel
Amsterdam, Holland
July 31 ö August 4, 2002

	Specific laws governing collection & processing of personal data	Implementation of principles set by EU Directive n¡95/46	Specific provisions for sweepstakes and prizes promotions: a) in general b) performed on line	Specific provisions for SMS	Specific provisions for e-mail advertising	Specific provisions for cookies	Decisions set by Courts, Self Regulation or Administrative Authority concerning said issues
Austria	YES	YES	NO specific provisions for sweepstakes and prizes promotions	NO specific provisions for sms	NO specific provisions for e-mail advertising	NO specific provisions for cookies	No cases
Belgium	YES	YES	No specific provisions for sweepstakes and prizes promotions, general rules on data protection apply	No specific rules on SMS. Rules on direct marketing apply: e.g. the recipient's opt-out right.	No specific rules on e-mail advertising. Rules on direct marketing apply: e.g. the recipient's opt-out right.	NO specific provisions for cookies	No cases
Spain	YES	YES	NO specific provisions for sweepstakes and prizes promotions	NO specific provisions for sms	NO specific provisions for e-mail advertising	NO specific provisions for cookies	No cases
France	YES	NO	NO specific provisions for sweepstakes and prizes promotions. Distance sales regulations apply. Promotions on line: data protection transfer out of EU shall be protected on European level.	NO specific provisions for sms. The CNIL (Commission Nationale de l'Informatique et des Libert?s) approves & applies the EU Directive principle: prior express consumer's consent is required before sending sms	NO specific provisions for e-mail advertising The CNIL: - advises companies to use opt-in methods. - considers opt-out methods unfit for personal data protection.	NO specific provisions for cookies. The CNIL: considers not necessary opt-in for cookies - requires companies to prior inform users of outcomes of the use or refusal of cookies.	Yes, they consist of those opinions expressed by CNIL on the issues of spamming via sms, and e-mail, and on cookies.
Germany	YES	YES	No specific provisions for sweepstakes or prizes promotions.	NO specific provisions for sms	NO specific provisions for e-mail advertising	NO specific provisions for cookies.	No cases.
Italy	YES	YES	No there are no specific provisions concerning sweepstakes & prizes promotions: the general provisions concerning data collection and processing are applicable. Therefore the participant's prior consent to his personal data collection and processing is required.	No there are no specific provisions concerning sms. Rules providing modalities and grants for directories of mobile's subscribers (Law by Decree n¡171/1998) apply. According to them subscribers: Must be prior informed about the use and purposes of said directories, have the right to opt if they want to be included or not in the directories, may decide which of their personal data can be inserted in directories (e.g. the address), have the right to express their prior consent to the eventual use of their phone number for other purposes (advertising, direct marketing, market research,..) by adding a symbol.	Not yet specific provisions as to e-mail ad. The following provisions apply: Law by Decree n¡171/1998, art. 10: "the use of automated call'g system without human intervention for advertising or direct marketing may only be allowed with subscriber's prior express consent". Leg. Decree n¡185/1999, art. 10: the use of a means of distance communication (telephone, e-mail) requires prior consent. Other means may be used only if the consumer is not opposed. The Privacy Guarantee has finally promoted the adoption of codes of conduct and professional practice aimed to regulate: communication and information services via electronic means, & the using or processing of p. data for sending ad & direct marketing.	No specific provisions. For granting an effective protection of Italian users' personal data, it has been provided that cookies introduced through non- EU web sites and addressed to users in Italy are falling under Italian law. The controller trough its local representative must inform the data subject as to processing and obtain his prior consent as to this purpose.	Yes, there are decisions adopted by the Guarantee for Privacy with respect to the legality of spamming.
Ireland	YES	YES, partially implemented (it mainly deals with the transfer of data to other countries). The remainder shall be implemented in January 2003.	No specific provisions for sweepstakes or prizes promotions. General rules apply: data controllers & processors must register with the Data Protection Commission.	NO specific provisions for sms. Direct marketing companies must register with Data Protection Commission.	NO specific provisions for e-mail advertising. See precedent column.	NO specific provisions for cookies	No cases.
Netherlands	YES	YES	NO specific provisions for sweepstakes or prizes promotions.	No specific provisions for sms.	No specific provisions for e-mail advertising.	No specific provision for cookies. Cookies and registration of visit to websites are allowed as long as this information cannot be traced to a private person. In that case the laws on data protection apply and permission have to be asked.	No cases
Sweden	YES	YES	No specific provisions for sweepstakes & prizes promotion.	No specific provisions for sms.	No specific provisions for e-mail advertising.	No specific provisions for cookies.	No cases.
United Kingdom	YES	YES	YES, the advertiser or promoter can use the individual participant's personal data for purposes which are obvious to the data subject or pursuing to the purposes of operating the sweepstakes or prize promotion or for which the data subject has given "informed consent".	No specific provisions. Telecommunications (Data Protection and Privacy, Direct Marketing) Regulations apply.	No specific provisions, general rules for fair collection and processing of Personal data apply.	Cookies are already subject to the provisions of the Data Protection Regulation and may only be used if the data subject has given his informed consent	Yes decisions with respect to said issues have been adopted by the Advertising Standard Authority, a body independent of both the Government and the Advertising industry responsible for advertisements.
*Czech Republic	YES	YES	YES First & second name address from such promotions can be used for marketing purposes without data subject's approval.	No specific provisions for sms	No specific provisions for e-mail advertising	No specific provisions for cookies.	No formal decisions of penalties, but informal statements
Hungary	YES	YES, partially Although Hungary is not a member of the EU, on September 7th,1999 the e has publicly declared that Hungary ensured an adequate level of protection for personal data within the meaning of the Directive.	No specific provisions. a) It should be verified whether data processing activity is performed while organizing sweepstakes. If so general rules concerning personal data protection shall apply. b) Legal regulations on the organization of sweepstakes will apply to sweepstakes activities from the territory of the Republic of Hungary trough communication equipment and networks. Additional rules shall apply: the advertising agencies and publishers must keep a register with all the persons that have expressed their written consent to receive ad. Therefore they may not send to those persons any ad. Addressed should be informed how and where he may opt-out.	Yes, see the precedent column.	Yes, see the precedent column.	No specific provisions for cookies.	No cases.