The Information Commissioner’s Office (ICO) has announced that it will resume its investigation into the ad technology sector, or adtech, after an eight-month suspension due to the Covid-19 pandemic.
His research on real-time bidding (RTB), the practice of buying and selling ad inventory in instant algorithmic auctions, began in 2019 in response to concerns about the implications of RTB, which relies on the collection and marketing of personal data. Internet users.
These behind-the-scenes auctions are responsible for many of the advertisements that people may perceive as “following” them on the Internet, and the data collected to support the practice may include personal interests, location, income, marital status, age, educational level. , gender and sexual orientation.
“Enabling transparency and protecting vulnerable citizens are priorities for the ICO,” said ICO Deputy Commissioner Simon McDougall. “The complex RTB system can use people’s sensitive personal data to serve ads and requires the explicit consent of people, which is not happening at the moment.
“Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk from these counterparties, also raises questions about the security and retention of this data.
“Our work will continue with a series of audits focused on digital market platforms and we will be issuing assessment notices to specific companies in the coming months. The result of these audits will give us a clearer picture of the state of the industry. “
The resumption of the investigation will also consider the role of data brokers, following the ICO investigation of offline direct marketing services, which resulted in an enforcement action in October 2020 against the credit reference agency. Experian and others.
“All organizations operating in the adtech space should assess how they use personal data as a matter of urgency,” McDougall said. “We already have complete guidance in place in this area, which applies to RTB and adtech in the same way as it does to other types of processing, particularly with regard to consent, legitimate interests, data protection by design and impact assessments. of data protection.
“We are also continuing to work with the Competition and Markets Authority to consider Google’s privacy sandbox proposals to phase out third-party cookie support in Chrome.”
Mark Thompson, global leader of KPMG’s Privacy Advisory Practice, said it was not surprising that RTB was back under the microscope.
“While many in the industry may have breathed a sigh of relief when the ICO initially paused its investigation, today’s announcement should come as no surprise and should be taken as a real signal of intent from the regulator,” he said.
“Organizations must now understand their exposure to the risk of the issues identified by the ICO, that is, do they know what personal data they share with the ecosystem and the data protection laws that apply, how transparent they have been with their users and if they analyze your understanding of your supply chain risk.
“Many organizations will need to analyze the actions taken after recent audits by the regulator. These audits can quickly turn into compliance notices requiring costly changes to fix problems in a short time. “
In October 2020, the digital privacy advocacy organization The Open Rights Group filed a legal complaint against the closure of the investigation, saying that the advertising companies were “driving a car and horses” through the General Regulation of Protection of Data and accusing the ICO of not putting an end to clearly illicit practices.
It was two ORG members, CEO Jim Killock and advisory board member and digital rights specialist Michael Veale of University College London, who filed the initial 2018 complaint that prompted the investigation.
In a statement responding to the reopening of the investigation, Killock said there was no point in closing the complaints as if they were resolved, just to continue investigating the industry anyway.
“By closing our complaint, the ICO is in effect avoiding its liability duties to update complainants and resolve their complaints,” he said. “If the ICO can act in this way, the complaints process is empty.
“By mistakenly closing our complaints, the ICO may believe that it does not have a deadline or the need to end these complaints. Therefore, we will continue to press for it to be resolved through the Court. The case has already been transferred by fast track to the Superior Court, given the importance of the issues involved ”.
Killock added: “The ICO has had two and a half years since our complaint. The ICO has resumed its policy of issuing threats to the industry, but has yet to take any meaningful enforcement action. “