ICO resumes investigation of the adtech industry

The UK Information Commissioner’s Office (ICO) is resuming its investigation into real-time bidding (RTB) and the adtech industry after a nine-month hiatus due to the Covid-19 pandemic.

ICO Deputy Commissioner Simon McDougall said the regulator will be running a series of audits over the coming months that will focus on digital marketing platforms. The watchdog is also planning to send review notices to specific companies as part of the investigation in order to gain a clear understanding of the state of the industry in the UK.

Enabling transparency and protecting the data of vulnerable citizens are the main priorities of the ICO, according to McDougall. He added that RTB auction systems require explicit consent to use people’s personal data for advertising, which is not currently done.

“Sharing personal data with potentially hundreds of companies without properly assessing and addressing the risk posed by these counterparties also raises questions about the security and retention of that data,” he added.

The announcement of the ICO comes more than two months after data protection officers from the Open Rights Group (ORG) filed a legal lawsuit against the ICO for allegedly failing to stop illegal adtech practices in the UK.

Jim Killock, executive director of ORG, and Michael Veale, lecturer in digital rights at University College London, filed the lawsuit.

The ORG claimed the ICO had fully completed its investigation in the adtech industry without taking appropriate action against the culprits.

At the beginning of September 2018, Killock and Veale filed a complaint with the ICO about systematic violations of the GDPR by the adtech industry and the Internet Advertising Bureau (IAB). They argued that the adtech industry’s RTB system does not meet the requirements of the GDPR that companies must provide adequate security for people’s data.

In response to the complaints, the ICO ordered an investigation and found that there were indeed many systemic issues with industry practices such as: B. sharing of browsing history and personal information of users without control over who can access that data. The regulator said it was concerned about the industry’s use of personal data in the RTB component of programmatic advertising.

In 2019, McDougall stated that the adtech industry should correct its practices, such as lack of clear consent to process data from “special categories” such as: B. political and sexual orientation.

Despite finding multiple violations of the GDPR, the ICO announced in May that it would suspend its investigation to avoid “undue pressure on an industry” during the pandemic. However, it added that it was concerned about the adtech industry and would resume work in the coming months.

The freeze is over now and audits are expected to begin soon.

The research focuses on RTB auctions – the process by which advertisers select ads to be shown to Internet users. The auctions, which take a few milliseconds to complete when the web pages load, offer little chance of user approval. Sometimes they can also use special category data to display ads to users.

The ICO investigation will also assess the role of data brokers in the adtech ecosystem.

The Data Watchdog conducted an investigation into the data brokerage activities of the credit agencies Experian, Equifax and TransUnion last year. At the time, an enforcement notice was issued to Experian instructing the agency to make changes to “how we treat individuals’ personal information as part of their direct marketing services.”