Katie Hewson, Partner at Stephenson Harwood opened the panel at Valuable Data, Priceless Privacy, PL&B’s 37th Annual International Conference by setting out the relevant legal framework – the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) – Reg 6 (see box below). The broad principle underpinning the law is simply that consent is required for organisations to store information on, and gain access to information collected from, a connected device. There are exceptions, but they are few and narrow.

She explained that this was the basis of UK as well as EU law, under the ePrivacy Directive. Although EU countries implement it in varying ways, the law’s fundamental principles apply to all EU countries and there is a move towards harmonisation: the European Data Protection Board (EDPB) has set up a Cookie Task Force to improve enforcement coordination. Hewson pointed out that this regulation is likely to remain relevant for the foreseeable future, as the EU’s proposed ePrivacy Regulation is not making progress.