10 Takeaways from ICO’s Update Report
The ICO has published an Update Report on AdTech and Real Time Bidding (RTB). The clue is in the word “update” in that it has decided to take a thoughtful and iterative approach to tackling the multiple and complex issues associated with the use of personal data in programmatic advertising. For now, the focus is on RTB, which is a subset of the programmatic landscape. However, we can assume that what happens in this area will impact other areas of programmatic advertising.
View our Adtech Webinar held in June
Here are our top take outs from the ICO update:
1. Consent or LI?
The current methods for obtaining consent as a lawful basis are insufficient and lack transparency, whilst opportunities to use legitimate interest are limited
2. Special Category Data
Processing data fields that constitute special category data requires explicit consent of the data subject. This is not occurring
3. Profiling
There is concern about the widespread processing of personal data to create profiles in way which the ICO feels is disproportionate and intrusive
4. Too much data?
There is a lack of insight as to whether all the personal data being collected actually needs to be processed in order to achieve the intended advertising outcome
5. Reliance on contracts
There is an inappropriate reliance on contractual agreements to protect how bid request data is shared, secured and deleted
6. Lack of DPIAs
Amongst RTB participants, there appears to be evidence of an absence of good data governance with limited use of DPIAs
7. Good data governance
The ICO is aware that programmatic advertising is here to stay but says that appropriate and responsible data protection practices are crucial
8. Vulnerable publishers?
The ICO is also mindful that action could have a detrimental effect on the economic health of vulnerable publishers
9. Continued collaboration
The ICO intends to continue to consult with interested parties including IAB Europe and Google as well as other European DP authorities
10. Regulatory action
The ICO have given notice that it intends to intervene in the market and has given the industry 6 months to start making changes
To their credit the ICO has consulted widely to make sure they’ve gained a complete understanding of the challenges. Is the ICO being too tough or too lenient? The activist groups are impatient for action whilst some agencies, brands and media owners may be in denial about the need to change. Notwithstanding the differing views, this report sets out a very clear direction of travel and the various players in the advertising industry need to pay attention. The ICO has given fair warning that they will start to take action sooner rather than later.
Julia Porter, DPN Board Member & Senior Associate at Opt-4 – 21 June 2019
HELP IS AT HAND
If you would benefit from practical advice on what steps you should take next, whether you operate in the adtech space or not, the data protection consultancy Opt-4 has experienced commercially savvy consultants on stand by to help. Email: info@opt-4.co.uk or Tel: 020 3858 9614
Copyright DPN
The information provided and the opinions expressed in this document represent the views of the Data Protection Network. They do not constitute legal advice and cannot be construed as offering comprehensive guidance on the EU General Data Protection Regulation (GDPR) or other statutory measures referred to.
