What is the UK GDPR?
Since Brexit the General Data Protection Regulation (the GDPR) no longer applies in the UK. But it kind of does anyway because the UK implemented its own version of the GDPR.
In order for there to be a UK GDPR in the post-EU-United Kingdom, there needed to be a primary legislation that could envelope it. Luckily there was one, called the Data Protection Act 2018, which was passed by the UK Parliament already in 2018.
One could say that because, formally, the UK GDPR is part of the Data Protection Act 2018. Or as the Government in the UK writes on their site:
Why did this primary law come into force on the same day as the GDPR?
Because the UK had to, or chose to, create a data protection framework âinhouseâ that could align with the EU GDPR. They basically wanted to roll out the red carpet for the GDPR so it felt comfy and welcomed in the UK legal landscape in its unaltered entirety, and thus could be consistently implemented across the country.
The need for data flow between the UK and EU
EXPERTS OPINION
What do you think increased enforcement activities from the ICO will mean for digital marketers and advertisers moving forward in the UK? What is your advice to them?
“Right now, marketers must prepare as well as they can, but they shouldnât be overly fearful of the ICO. The truth is actual fines for marketing havenât occurred in over a year! And these fines are just for SMS spam, Robo calls or unsolicited emails. I canât see any cookie banner fines or remarketing fines in the list.
My advice is always to maintain a strict adherence to privacy compliance. But if you are especially concerned about what the ICO are actually clamping down on, keep a close eye on what fines have been issued by the ICO.
Another piece of advice is to find out tools/tech the ICO are using and to run the testing on your own site before they do. We developed a Consent Mode Monitor tool to check your GTM setup compliance and whether you have Consent Mode v2 active. This could be the type of thing the ICO uses.”
![](https://cookieinformation.com/wp-content/uploads/PhilPierce.png)
Secondary legislations for UK GDPR
Primary legislation like the Data Protection Act 2018âand subsequently the UK GDPRâneeds detailed rules and guidelines to be actionable. These secondary supporting regulations are also known as statutory instruments (SI).
The 4 most important secondary regulations for the UK GDPR
4. The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR):
So this one is special. PECR is not strictly part of the UK GDPR framework. But it works so closely alongside itâto regulate electronic marketing, cookies, and other aspects of online privacyâthat it feels inseparable from the framework in practice.
The UK GDPR in a nutshell
Alongside its various supporting regulations, plus the PECR (the “UK version” of the ePrivacy Directive), this act constitutes the legal framework for data protection in the UK.
Now, the question begs: How do you, as a marketer, become compliant with the UK GDPR?
As with its template, complying with the UK GDPR might seem daunting. Let’s make it less so.
EXPERTS OPINION
What advice would you offer marketers who want to adhere to current and upcoming UK data and tracking protection laws? Additionally, what are your thoughts on the ICO’s enforcement activities?
“It is important to understand which market you serve. Do your compliance obligations mainly lie in the UK, possibly the US, or continental Europe?
I would not be surprised if the UK moves towards an opt-out model for data privacy within the next five years instead of the current opt-in obligations. The main issue is the right to action, which allows individuals to sue for data privacy violations. This is being tested in UK courts, while the US seems to oppose such a right, as shown by Vermont’s recent veto of similar legislation.”
![](https://cookieinformation.com/wp-content/uploads/aureliscircle.png)
Is complying with the Original GDPR enough?
If I am compliant with the ePrivacy directive and the GDPR, am I then also compliant with the UK GDPR?
The answer to this question is mostly yes. But there are some tweaks.
As stated previously, the UK GDPR mirrors the original GDPR closely. Still, there are some differences you need to be aware of due to the Brexit adjustments.
- Data Transfers
- UK representatives
- ICO Fees
Data Transfers
UK Representatives
ICO Fees
How do you comply with the UK GDPR?
The UK GDPR is a big piece of legislation.
How you, as a website owner or marketer, need to address it depends on the company you represent and what they/you want to do, need to do, and have to do regarding collecting, storing, and processing personal data.
The ABC of the UK GDPR
1. What is the scope of the UK GDPR?
Every marketing agency, company, or organisation that processes the personal data of individuals in the UK, regardless of where in the world the company is based, has to comply with the UK GDPR by having legal grounds for it. Personal data is any data that canâdirectly or indirectlyâidentify an individual, from name to online identifiers like cookies and IP addresses.
2. What are the principles of the UK GDPR?
3. What rights do the UK GDPR address?
So, this one is also pretty straightforward. An individualâthe data subjectâhas the right to their own data, which means that they are in charge of what you are allowed to do with it.
4. What obligations do I have under the UK GDPR?
As an organisation or company, you need to have processes and tools in place that allow you to handle personal data in a way that complies with all the requirements of the UK GDPR.
Summary
Also read: What is the UK Data Protection and Digital Information (No. 2) Bill?Â
EXPERTS OPINION
![](https://cookieinformation.com/wp-content/uploads/DanTruman.png)
Where the UK GDPR meets the "UK ePrivacy Directive"
As mentioned, the UK has its version of the ePrivacy Directive (Directive 2002/58/EC, updated to 2009/136/EC where the consent requirements were changed from opt out to opt in) called the Privacy and Electronic Communications Regulations (PECR).
As the EU version, the PECR gives people specific privacy and confidentiality rights regarding electronic communications. And similar to how it is in many EU member states the PECR overlaps with the GDPR/UK GDPR.
The central role of consent in the UK GDPR
The UK GDPR has 6 (six) legal grounds or lawful basis one can lean on to collect and process personal data. However, to track and retarget visitors to your website, consent is the go-to legal basis.
- Consent
- Contract
- Legal obligation
- Vital interests
- Public tasks
- Legitimate interest
Note that the PECR aligns with the ePrivacy Directive regarding consent. This means both require consent for using cookies and other similar technologies. Consequently, the ICO recommends that consent is the only lawful basis for using cookies. Donât even think about using legitimate interest.
What is consent?
The first one on that list helps bridge the PECR with the UK GDPR regarding consent. It does so by stating that what the PECR means by consent is how the UK GDPR defines what consent is. This means that consent counts when the person has been able to give it freely to something that is specified and specific, and they have been able to do that based on clear and unambiguous information.
- you have to be able to prove it,
- you cannot bundle consent with other other terms and conditions,
- the consent request must be easy to understand and access,
- it must be easy for your visitor to withdraw consent at any time.
What is cookie consent?
- A user who visits your website without touching the cookie-banner is not consenting. The person must actively give their consent to non-essential cookies.
- Your website must inform the visitors what cookies you want to set and what they do before they can say yes or no.
- And suppose you use scripts that set third-party cookies. In that case, you have to clearly and specifically name who the third parties are and explain what they will do with the information.
- You cannot use pre-ticked boxes or toggles set to “on” or anything similar for non-essential cookies.
- You must give visitors control over non-essential cookies and ensure they have access to the site even if they say no to these cookies.
- Last but not least, setting any non-essential cookies or running similar technologies before the user consents is a big no-no.
What is a strictly necessary cookie?
Itâs easy to get confused when it comes down to the technicalities of cookies. But to sort out what makes some cookies necessary and others not, one can simply conclude that it is about whether they are vital for a website to work properly or not.
What are the consent requirements for cookies in the UK?
If you want to store cookies on a visitor’s browser, for example, and, by doing so, access or store information, you must have consent. The PECR mandates this.
So, this consent requirement is not a UK GDPR thing but more of an electronic communications thing Ă la PECR.
And yes, the same relationship exists between the ePrivacy Directive and the GDPR.
*The UK GDPR states that online identifiers, such as cookie identifiers, can be linked to individuals and used to create profiles, making them identifiable.
Do the UK GDPR and PECR cookie requirements only apply to websites?
No, not at all. The rules apply to ANY technology that stores information or access information stored on your users’/visitors’ devices.
Do the cookie requirements also apply to fingerprinting?
Yes, as you have probably guessed, the cookie requirements under the PECR also apply to fingerprinting. There is plenty of room under the notion “[…] and other similar technology.”
The ICO underlines that the PECR covers any technology that stores or accesses information on a user’s device.
- Device configuration data
- Network protocol data
- CSS information
- JavaScript objects
- HTTP header information
- Clock information
- TCP stack variations
- Installed fonts and plugins
- API usage
Do the PECR and the UK GDPR ban tracking?
No, the PECR (and the UK GDPR) do not ban the use of these technologies, but they require you to inform your visitors and users about them and get their consent before you store or access information on their devices.