A cookie is a piece of information in the form of a very small text file that is placed on an internet user’s hard drive. The information the cookie contains is set by the web page server and it can be used by that server whenever the user visits the site. People are currently experiencing cookie issues on a daily basis due to the cookie bars, which can be found on almost every website.

At European Union level, the cookies are currently regulated in the Directive no. 2002/58/EC (a new e-privacy EU Regulation is in progress). According to article 5, sec. 3 of the Directive: “Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.”

This directive has been transposed by the Slovak Republic via the Act no. 351/2011 coll. on electronic communications as amended: “Anyone who stores or obtains access to information stored on a user’s end device, shall be entitled to do so only if the user concerned has given his or her consent having been provided with clear and comprehensive information about the purpose of its processing; the use of the appropriate settings of a web browser or other computer program is also considered a consent for this purpose. […] This shall not prevent any technical storage or access to data the sole purpose of which is to transmit or facilitate the transmission of a communication over a network or where this is strictly necessary for an information society service provider to provide an information society service explicitly requested by the user. “

According to the EU Directive no. 2002/58/EC, only necessary cookies can be used without the consent of the user. Other cookies, as analytical or marketing cookies, need the consent of the user, who has been provided clear and comprehensive information. The current Slovak Electronic communications act has added beyond the scope of the Directive, that the use of the appropriate settings of a web browser or other computer program is also considered a consent for this purpose. It should be also noted, that in Slovakia we have no praxis or statements from the regulator (the Office for the regulation of electronic communications and postal services). Also, no fine is attached to the breach of the provision in question of the current Slovak Electronic communications act. However, the Office for personal data protection may indirectly control and penalize compliance with the provision in question through the basic principles of personal data processing in the GDPR Regulation, in case of cookies containing personal data.

As mentioned before, the addition in the current Slovak Electronic communications act, is beyond the scope of the EU Directive and also contrary to the case law of the Court of Justice of the EU. According to the judgment in the case Planet49 GmbH, the consent referred to in the Directive is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent. The provision of the Directive is not to be interpreted differently according to whether or not the information stored or accessed on a website user’s terminal equipment is personal data. The information that the service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.

As the EU Directive no. 2002/58/EC has not been transposed properly by the Slovak republic, the Slovak parliament has adopted a new Electronic communications act, which will enter into force on 1.2.2022. According to the new Electronic communications act: “Anyone who stores or obtains access to information stored on a user’s end device, shall be entitled to do so only if the user concerned has given his or her provable consent. […] This shall not prevent any technical storage or access to data the sole purpose of which is to transmit or facilitate the transmission of a communication over a network or where this is strictly necessary for an information society service provider to provide an information society service explicitly requested by the user. “

According to the cited provision of the new Slovak Electronic communications act, apart from necessary cookies, provable consent of the user is needed. The use of the appropriate settings of a web browser is not any more considered a consent for this purpose. To follow the case law of the Court of Justice of the EU, the consent cannot be given via a pre-checked checkbox. A breach of this obligation is according to the new Act subject to a fine in the amount of between EUR 200 and 10% of the turnover for previous accounting period. Person who is not an entrepreneur can get a fine between EUR 200 and EUR 20.000.  Although the new Act will enter into force on 1.2.2022, these conditions for the provision of a consent should be respected also today, to be in compliance with the EU law. As mentioned before though, currently no fine is attached to the breach of this provision in the Slovak electronic communications act.

Conclusion

We recommend you to follow the new Slovak Electronic communications act when setting the cookies on your webpage. The cookies on your website should be in compliance with the following conditions:

• Only necessary cookies can be used without the consent of the user.
• Other cookies, as analytical or marketing cookies can be used only if the user concerned has given his or her provable consent. These cookies cannot be used based on a legitimate interest of the website operator.
• The consent should be given via a cookie bar, whereas a pre-checked checkbox is not acceptable. An implied consent is also not acceptable (“By using this site, you agree to the use of cookies”).
• The information given to the user must include the duration of the operation of cookies and whether or not third parties may have access to those cookies.

Questions regarding business or data protection law in Slovakia? We are happy to assist you with our partner:

Diana Oravcová attorney at law

Adriena Petrová attorney at law