The Internet and the Law

First edition

by Kevin M.Rogers


Chapter 5

Online Marketing

This update was last revised in August 2012

The changes to Directive 2002/58/EC on the processing of personal data and the protection of privacy in the electronic communications sector in relation to cookies took effect at the end of May 20121. The main change is that before a cookie is stored in the terminal equipment, the user needs to be provided with clear and comprehensive information and in return the recipient gives their consent to the cookie being used.

This is a significant shift is approach and does not come without controversy. The very nature of storing a cookie on terminal equipment and then determining whether or not that person has consenting to cookie user necessitates that personal data will be processed prior to the consent being obtained. Secondly, it is not clear whether this provision applies to all cookies, or to all cookies and spyware, or just those cookies that process personal data.2

1 Information Commissioner New EU Cookie Law (e-Privacy Directive. See:

2 For more see: Article 29 Working Party Opinion 04/12 on Cookie Consent Exception (June 2012). Available at:

Back to top

Chapter 7

Data Protection

This update was last revised in August 2012

On 25th January 2012, the European Commission published a proposal for a Regulation on the Protection of individuals with regard to the processing of personal data and on the free movement of such data (hereafter the 'Data Protection Regulation').1 It was noted that due to rapid technological developments and the ease of collecting, sharing and exchanging data, personal data is confronted with new challenges and that the original Data Protection Directive 95/46/EC was struggling to keep pace with the changes. In addition, as data subjects are becoming increasingly more liberal in sharing personal information publically and globally, often through social networking sites, more robust legislation is needed to respond to this challenging context.

The Data Protection Regulation has four main aims. It seeks to protect fundamental rights and aims to achieve this by providing a flexible legal instrument to respond to technological developments. It seeks to stimulate growth by adopting uniform data protection rules within the European Union and in turn provide legal certainty. Some of the current challenges of Directive 95/46/EC relate to the fragmented nature of the data protection legislation across the European Union and the widespread public perception that there are significant risks to engaging with online activity, which threatens economic activity and prosperity.

Some of the main reforms proposed by the Data Protection Regulation include a streamlined notification system, which would operate across the European Union and not just within individual member states, a broader definition of personal data to include 'any information' relating to the data subject2, increased access to personal data for the data subject (which includes the right to data portability and the right to object to profiling3) and also a higher burden for demonstrating consent as data controllers will need to show that there has been a clear affirmative action by the data subject.4 In addition, the extension of the jurisdictional reach of the Data Protection Regulation is proposed in Article 3, while there is also the introduction of a data security breach notification rule and a requirement that notification is given within 24 hours. Sanctions introduced by the Regulation are much tougher than those that current exist and include increased fines for serious data breaches of up to 2% of annual worldwide turnover.5 Enhanced protection is also provided to children under the age of 18.

One of the more controversial changes is found within Article 17 includes the right for the data subject to be 'forgotten'.6 This places a requirement on the data controller to erase all data held about a data subject where one of a number of grounds apply, including that the data is no longer necessary or the data subject withdraws their consent to the processing.

Whilst making the Regulation technology neutral with the aim of 'future proofing', there is a concern that once implemented the Regulation will be costly in terms of compliance. However, despite an implementation timetable estimated to take up to 20167, the Regulation has been broadly welcomed in terms of updating and modernising the legislation.8

1 Available at: See Commissions proposes comprehensive reform of data protection rules (2012) EU Focus, issue 294, pages 1-4.

2 Article 4(2).

3 Article 19.

4 Article 4 & Recital 25. This threshold is higher than Directive 95/46/EC, which requires that consent is 'freely given, specific and informed.' See Owen, M & Foster, R Data Protection: Much stricter data protection for EU citizens proposed (March 2012) E-Commerce Law and Policy, volume 14, issue 3.

5 Article 79.

6 Bernal, P. A. A right to delete? (2011) European Journal of Law and Technology, volume 2, number 2.

7 See minutes from an earlier stage of the discussions by the Working Party on Information Exchange and Data Protection (DAPIX), held 23-24 February 2012. Available at:

8 Information Commissions Office Initial response from the ICO on the European Commission's proposal for a new general Data Protection Regulation (25th January 2012). Available at:

Back to top

Chapter 8

Freedom of Expression and Defamation

This update was last revised in August 2012

In March 2011, the Ministry of Justice published a consultation on a Draft Defamation Bill. Much of this publication stemmed from the earlier work undertaken by Lord Lester and also the approach taken by the coalition government in seeking to secure a tighter harmony between safeguarding a person's right to free speech, while ensuring there is a robust mechanism in place to allow individuals to commence defamation claims. One of the key challenges has been that the United Kingdom has been seen as a forum of choice for people looking to bring a defamation claim as courts tend to favour the person commencing the claim. The draft bill seeks to remedy this in a number of ways:
  • The draft bill suggests a change to the test for bringing a defamation claim in clause 1 as a statement is not defamatory unless it has caused substantial harm to the reputation of the claimant. This is a change from the current approach which requires the defamatory statement to be made to at least one other party and damage is presumed. This clause also seeks to avoid the continued proliferation of vexatious claims.
  • Clause 6 of the draft bill suggests that the multiple publication rule adopted in the United Kingdom, as highlighted in the case of Loutchansky v The Times Newspapers Limited be replaced by a single publication rule. Currently, the principle is that each publication of a defamatory statement gives rise to a potential action. The Internet has posed a discrete problem here in that every time a website is viewed a new right of action arises and this means that website owners, editors, authors could be liable for a defamatory comment posted years previously. The introduction of the single publication rule means that a claimant would only be able to commence an action one year after the date of the initial publication, following the provisions outlined in section 4A of the Limitation Act 1980. In addition, the statement must be a 'statement to the public'. This seeks to avoid the challenges posed of defamation actions commencing when only a small handful of people have seen the offending article, as seen in Jameel v Dow Jones & Co.
  • Clause 7 makes some alterations to the jurisdictional aspects of commencing a claim. The court must satisfy itself that it is the most appropriate forum to hear the claim against a person who is not domiciled in England or Wales, taking into account all the places where the article has been published. The aim of this clause is to prevent the problem of 'libel tourism', where a claimant will choose the United Kingdom as their forum of choice.
The draft bill makes other, wider, proposed alterations to the law in this area, including alterations to some of the key defences, such as Privilege and the introduction of the defences of truth and honest opinion to replace the current defences of justification and fair comment respectively. The presumption in favour of a jury trial is also being removed.

The government's response to the draft bill was broadly positive , however it is noted that there are still a number of challenges in relation to the law and defamation, which remain unanswered. The draft bill does not consider liability for intermediaries, such as Internet Service Providers, although this is considered in the wider consultation.

During the Queen's Speech in May 2012, it was announced that a new Defamation Bill would be introduced during the next parliamentary session.

1 Ministry of Justice Draft Defamation Bill Consultation (March 2011) See also: Lord Lester's Defamation Bill: a distorted view of public interest? (2011) Communications Law, volume 16, issue 1, pages 6-18.

2 (2002) 1 All ER 652.

3 The courts do have discretion to extend this period if it is equitable to do so under section 32A Limitation Act 1980.

4 [2005] EWCA 75.

5 Ministry of Justice The Government's response to the Report of the Joint Committee on the Draft Defamation Bill (February 2012). Available at:

6 BBC News New Defamation Bill to 'protect freedom of speech' (9th May 2012). Available at:

Back to top