10 Takeaways from ICO’s Update Report
The ICO has published an Update Report on AdTech and Real Time Bidding (RTB). The clue is in the word “update” in that it has decided to take a thoughtful and iterative approach to tackling the multiple and complex issues associated with the use of personal data in programmatic advertising.
For now, the focus is on RTB, which is a subset of the programmatic landscape. However, we can assume that what happens in this area will impact other areas of programmatic advertising.
Here are our top take outs from the ICO update:
1. Consent or LI? The current methods for obtaining consent as a lawful basis are insufficient and lack transparency, whilst opportunities to use legitimate interest are limited
2. Special Category Data – Processing data fields that constitute special category data requires explicit consent of the data subject. This is not occurring
3. Profiling – There’s concern about the widespread processing of personal data to create profiles in way which the ICO feels is disproportionate and intrusive
4. Too much data? – There’s a lack of insight as to whether all the personal data being collected actually needs to be processed in order to achieve the intended advertising outcome
5. Reliance on contracts – There’s an inappropriate reliance on contractual agreements to protect how bid request data is shared, secured and deleted
6. Lack of DPIAs – Amongst RTB participants, there appears to be evidence of an absence of good data governance with limited use of DPIAs
7. Good data governance – The ICO is aware that programmatic advertising is here to stay but says that appropriate and responsible data protection practices are crucial
8. Vulnerable publishers? – The Regulator is also mindful action could have a detrimental effect on the economic health of vulnerable publishers
9. Continued collaboration – The ICO intends to continue to consult with interested parties including IAB Europe and Google as well as other European DP authorities
10. Regulatory action – The Regulator has given notice it intends to intervene in the market and has given the industry 6 months to start making changes
To their credit the ICO has consulted widely to make sure they’ve gained a complete understanding of the challenges. Is the ICO being too tough or too lenient?
The activist groups are impatient for action whilst some agencies, brands and media owners may be in denial about the need to change. Notwithstanding the differing views, this report sets out a very clear direction of travel and the various players in the advertising industry need to pay attention. The ICO has given fair warning that they will start to take action sooner rather than later.
Julia Porter, 21 June 2019
Copyright DPN
The information provided and the opinions expressed in this document represent the views of the Data Protection Network. They do not constitute legal advice and cannot be construed as offering comprehensive guidance on the EU General Data Protection Regulation (GDPR) or other statutory measures referred to.