UK Parliament. Author: FGC
On June 20, 2019, the UK Data Protection Authority, the Information Commissioner Officer (ICO), published an update report into adtech and real time bidding. The ICO is waiting for the adtech sector response to the report and will then undertake a “further industry review in six months’ time”.
The report focuses on Real-Time Bidding (RTB). RTB is a set of technologies and practices underpinned by advertising technology (adtech). It allows advertisers to automatically compete for available digital advertising space in milliseconds. The website publisher auctions a space on a website page, an advertiser buys it and an ad specifically selected for each of us appears on our screen.
The ICO researched how people’s personal data is used and shared in RTB and whether the processes used complied with the law – both General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR).
According to the report, the main concern is that the creation and sharing of personal data profiles “feels disproportionate, intrusive and unfair, particularly when people are often unaware it is happening.” “One visit to a website, prompting one auction among advertisers, can result in a person’s personal data being seen by hundreds of organisations, in ways that suggest data protection rules have not been sufficiently considered.”
In particular, the following RTB practices may lead to a violation of the data protection laws:
- profiling and automated decision-making;
- large-scale processing (including of special categories of data);
- use of innovative technologies;
- combining and matching data from multiple sources;
- tracking of geolocation and/or behaviour; and
- invisible processing.
Particularly the ICO saw issues in the following areas:
- transparency and consent. “It is difficult to identify lawful basis for the processing of personal data in RTB, and data subject are not duly informed of which personal data are processed;”
- data supply chain: “reliance on contractual agreements to protect how bid request data is shared, secured and deleted does not seem appropriate given the type of personal data sharing and the number of intermediaries involved.”
More information on the update report into adtech and real time bidding is available at https://ico.org.uk…
The update report into adtech and real time bidding is available at https://ico.org.uk…
For more information on how GDPR and EU cookie rules apply to your company: Francesca Giannoni-Crystal and Federica Romanelli