Serious criticism for processing personal data about website visitors Summary The Danish Data Protection Agency’s The case originated from the Danish DPA’s decision on decision January 28, 2021, to investigate the website The Danish DPA expressed serious criticism that, until www.alstrom.dk, following a complaint. the start of January 2021, Alstrøm’s processing of During a visit to the website www.alstrom.dk 18 different personal data about website visitors on www.alstrom.dk cookies were placed on the visitor’s device before had not been carried out in accordance with the rules obtaining consent. in GDPR, Article 6 (legal basis for processing). Alstrøm used Google Analytics to generate statistical The Danish DPA criticized that, after January 2021, information about website visitors. Alstrøm’s processing of personal data about website visitors on www.alstrom.dk had not been in accordance The case concerned two consent solutions: with GDPR, Article 6. 1. The first involved a piece of text giving the The Danish DPA expressed serious criticism that website visitor the option to choose ”read more Alstrøm’s implementation of the consent solution, at the about cookies” or ”close”. beginning of January 2021, had not been in accordance This solution was replaced in January 2021 by a new with GDPR, Article 5 (processing principles), and one where: Article 6. 2. The ”Accept” button was in orange font on a white background, blending in with the white background of the consent solution, while the ”ACCEPT ALL” button was in white font on an orange rectangular background, as shown in the image below: Necessary/Technical Functional Statistical Marketing ACCEPT ACCEPT ALL SHOW COOKIEDETAILS Published: 20-10-2021, Journal number: 2021-431-0125 Tags: 01 Legal basis for processing and principles for processing 104