Cookies were regulated by the ePrivacy directive back in 2009. The case raised above is about someone who had access to see the users' IP address. Handling training and authorisations for people with access to personal data is an ongoing job, not something you do once and forget.