The Information Commissioner’s Office (ICO) has announced that it will resume investigation into the advertising technology or adtech sector following an eight-month suspension due to the Covid-19 pandemic.
The investigation into real-time bidding (RTB), the practice of buying and selling advertising inventory in instant algorithmic auctions, began in 2019 in response to concerns about the impact of RTB supported by the collection and trading of personal data from RTB Internet users .
These behind-the-scenes auctions are responsible for many of the ads people think will follow them on the internet. The data collected in support of the practice can include personal interests, location, income, relationship status, age and educational level, gender and sexual orientation.
“Transparency and protection of vulnerable citizens are a priority for the ICO,” said ICO Deputy Commissioner Simon McDougall. “RTB’s complex system can use people’s sensitive personal data to advertise and requires people’s express consent, which is currently not the case.
“Sharing personal data with potentially hundreds of companies without properly assessing and addressing the risk posed by these counterparties also raises questions about the security and retention of this data.
“Our work will continue with a series of audits focused on digital market platforms and we will be issuing assessment notices to specific companies in the coming months. The result of these audits will give us a clearer picture of the state of the industry. “
The reopening of the investigation will also consider the role of data brokers following the ICO’s investigation into offline direct marketing services, which resulted in an enforcement action against credit bureau Experian and others in October 2020.
“All organizations in the adtech space should urgently review how they use personal information,” said McDougall. “We already have extensive guidelines in place in this area that apply to RTB and Adtech as well as other types of processing – particularly with regard to consent, legitimate interests, data protection through design and data protection impact assessments.
“We are continuing to work with the competition and market regulators to review Google’s proposals to protect the privacy sandbox to end support for third-party cookies on Chrome.”
Mark Thompson, global leader of the privacy advisory practice at KPMG, said it was not surprising that RTB was being re-examined.
“While many in the industry may have breathed a sigh of relief when the ICO initially paused its investigation, today’s announcement should come as no surprise and should be taken as a real signal of regulator intent,” he said.
“Businesses now need to understand the extent to which they are facing the issues identified by the ICO – whether they know what personal data they are sharing with the ecosystem and what data protection laws apply, how transparent they have been to their users, and whether they are questioning their understanding of their supply chain risk.
“Many organizations need to look at the actions that have been taken following recent reviews by the regulator. These audits can soon turn into enforcement notices that require costly changes to fix issues in the short term. “
In October 2020, the Open Rights Group, an advocacy group for digital data protection, filed a legal complaint against the completion of the investigation. She said advertising firms are “driving a bus and horse” under the General Data Protection Regulation and accused the ICO of failing to end clearly illegal practices.
It was two ORG members – Executive Director Jim Killock and Advisory Board member and digital rights specialist Michael Veale of University College London – who made the first 2018 complaint that prompted the investigation.
In a statement responding to the reopening of the investigation, Killock said there was no point in closing complaints as though they were being resolved only to investigate the industry further anyway.
“By closing our complaint, the ICO is effectively avoiding its accountability obligations to update complainants and resolve their complaints,” he said. “If the ICO can act this way, the complaints process becomes hollow.
“By closing our complaints incorrectly, the ICO can believe that it has no time frame or needs to close those complaints. We will therefore continue to push for a solution through the tribunal. Given the importance of the issues involved, the case has already been brought before the Supreme Tribunal. ”
Killock added, “The ICO has been two and a half years since our complaint. The ICO has resumed its policy of threatening the industry but has yet to take meaningful enforcement action. “