The UK Information Commissioner (ICO), Christopher Graham, announced at the IAPP Data Protection Intensive on 25-26 April 2012, that enforcement of the cookie law will be ''pragmatic and realistic'', when the moratorium on enforcement is lifted on 26 May 2012.

The UK cookie consent law - which implements the EU Privacy and Communications Directive - came into effect last year in May, but enforcement was stalled by the ICO to allow businesses time to find adequate solutions. The law requires users' consent before cookies can be installed on their computers.

''Despite the sensationalist claims made by some, the truth is that the threshold for monetary fines under UK data protection law is so high, that fines for this type of breach (in the UK!) are extremely unlikely'', said Eduardo Ustaran, Partner at Field Fisher Waterhouse. ''However, it would also be extremely foolish to assume that in the absence of fines, non-compliant websites are simply off the hook. Quite the opposite - the ICO will focus instead on ensuring that infringing sites are forced to get their house in order within a limited period of time and therefore, both undertakings and enforcement notices will become the preferred enforcement tool in this area.''

Commissioner Graham also stated that the enforcement of analytics cookies is not the ''top priority for the ICO''. Separately, on 1 May 2012, the French Data Protection Authority (CNIL) issued revised guidance on cookies, stating that analytics cookies will be exempt from the new rules if publishers provide clear notice to visitors about their use of cookies, the user's right to access information is ensured, and information is not linked to identifiable users, among others.

''The CNIL is now in line with other EU Member States such as Ireland'', said Gabriel Voisin, Associate at Bird & Bird LLP. ''However, this exemption for analytic cookies is yet to be applicable everywhere as other countries like the UK do not go down that road.''

EU: BCR Webinar: Top 5 takeaways

EU: Soundbites from the EU Parliament seminar on the data reform

EU: WP29 clarifies DPAs' expectations of BSPRs

EU: 'Three possible dates' put forward for the LIBE vote on data proposals

USA: Data brokers urged to review privacy practices after FTC warnings

USA: NLRB: blanket confidentiality rule during employee investigations 'invalid'

China: MIIT draft rules expand telecoms & IISP obligations

Singapore: Personal Data Protection Commission to launch May 2013

Australia, OAIC: Data security 'critical' to meet upcoming requirements

USA: Commerce Committee criticises industry failure to adopt DNT

USA: SEC and CFTC issue Red Flag Rules for financial institutions and creditors