The DPC’s Cookie Guidance will have a big impact on web developers. Whether web development is part of your business or you contract the maintenance of your website you should understand these impacts.

In previous posts I have noted the importance of cookies and introduced the Cookie Check tool.

In this post I will focus on how this guidance will impact on companies who develop websites (whether their own or for clients) when enforcement starts on 5th October 2020.

If you maintain your own website

Confirm that your website complies with the cookie guidance (cookie check tool). If it does not, bring the site within compliance. The Preliminary Cookie Compliance Report provides recommendations of the changes required to achieve compliance. If you wait for an enforcement notice you will be under a hard deadline to complete the work.

If you contract a web developer

You depend on a web development company for the maintenance of your website. Confirm that your website complies with the cookie guidance (cookie check tool). If it does not comply instruct your maintainer to bring the site within compliance. The Preliminary Cookie Compliance Report provides recommendations of the changes required to achieve compliance. If you wait for an enforcement notice you will be under a hard deadline to complete the work.

If you maintain websites for others

In addition to compliance for your own website, you need to consider the compliance status of your client websites. The cookie check tool and preliminary cookie compliance report can you help to understand who is a risk and the scope of work required to bring the sites within compliance.

The greatest risk is that a number of your clients are all issued enforcement notice at the same time. They will be competing for your maintenance resources as they will all have the same hard deadline to remedy the non-compliance.

Enforcement notices and judicial review

The Data Protection Commission can issue an Enforcement Notice (Data Protection Act 2018, Section 133) detailing the actions required and a date by which such actions should be completed. The act allows that an urgent notice should specify a date not less than seven days from the date of the notice.

The DPC has indicated during its roadshow that, considering the six month introduction period, enforcement notices are likely to be considered urgent. A circuit court appeal is required to challenge an enforcement notice.

They have also indicated that in egregious cases they may consider judicial remedy (Data Protection Act 2018, Section 117).