Incredimail 2012 Annual Report Download - page 36

United Kingdom and European Union
The U.K. Data Protection Act and similar European Member State implementations of the European Union Data Protection Directive
establish a core framework of rights and duties which are designed to safeguard personal data processed within the European Union. There are
other ancillary and related laws and regulations across the European Union which combine to create an extensive regulatory regime. The core
data privacy framework is underpinned by a set of eight straightforward principles which we must apply to safeguard personal data. Any failure
to ensure that personal information is processed in accordance with these principles could result in criminal or civil penalties as well as
potentially damage our customers. E.U. data protection legislation further prohibits the transfer of personal data to non-
EEA countries that do not
meet the European “adequacy”
standard for privacy protection. The E.U. privacy legislation requires, among other things, the creation of
government data protection agencies, registration of processing with those agencies, and in some instances prior approval before personal data
processing may begin. Such legislation and the associated compliance practices implemented under such legislation may impose significant
additional costs or restrictions on our business or subject us to additional liabilities.
On November 25, 2009, E.U. Directive 2009/136/EC was enacted, which amended certain p
rior directives affecting online service
providers respecting the processing of personal data and the protection of privacy in the electronic communications sector. As mentioned above,
this amendment tightened the restrictions around the use of cookies with E.U. consumers and this amended "ePrivacy Directive" now requires
that:
"
the storing of information or the gaining of access to information already stored in the terminal equipment of a subscriber or user is
only allowed on condition that the subscriber or user concerned has given his or her consent."
Some local legislation is now implemented by Member States but others, missing the prescribed deadline for such implementation of
May 2011, have not resolved and published their approach to the required changes to legislation. Much about how this new directive may affect
our operations in the European Union remains unknown until E.U. Member States pass their own implementing legislation. Valuable associated
regulatory guidance on best practice in those Member States that have implemented the rules is only slowly being issued, leaving additional
uncertainty around the changes which may be required of our business. While a number of self-
regulatory compliance regimes are emerging,
none are fully endorsed as offering a full route to compliance by the regulators and few of the current attempts at compliance within our industry
are consistent and there is no definitive picture of "best practice" at the current time in our industry. As others in the online market, we are
observing the changes in online practice made by our peers and recognize a likely need to amend our practices.
Notably, and as mentioned above, Article 66 of the ePrivacy Directive requires both transparency about cookie use and that a provider
obtain a user’s consent before a cookie is placed on the user’s computer. While a user’
s choice in browser settings to allow cookies has been
deemed to suffice in several European jurisdictions, these technologies have not yet emerged and as a consequence it is likely that some form of
affirmative step is to be necessary to enable a user to opt in before or at the time the cookie is placed. As clarity around these new rules and
associated guidance emerges, we might be required to incur costs to ensure compliance and consider solutions or limitation of access to our
services, and we might become subject to additional liability. Inevitably the solution required may also have a negative impact on consumer
adoption and the types of services and revenue we can derive from cookie use and the information such use can derive. However, there are a
number of industry-
led initiatives leveraging browser settings and other advances which may lead to more effective and acceptable routes to
legal compliance.
Similar to the U.S. CAN-
SPAM Act of 2003, the European Union has an equally tough legal regime as a result of the Privacy and Electronic
Communications Directive (2002/58/EC), which specifically applies to the sending of unsolicited commercial email. All E.U. Member States
now have implementations within their own national legislation which implement these rules (though not always on the same basis, which
complicates our compliance). As a consequence, direct marketing email messages may be sent only to subscribers who have given their prior
consent ("opt-
in") although certain exemptions apply where there has been a prior course of dealing with the consumer in question, which can
provide our business with more flexibility. We are challenged by these (and associated) rules when mounting E.U. email campaigns, and non-
compliance would expose us to potential fines, regulatory investigations and sanctions on a country-to-
country basis, as well as potentially
reputational damage.
30