ICO AdTech report: a wake-up call for the industry
The Information Commissioner’s Office (ICO) in the UK published on the 20th of June a report on adtech and real time bidding. The report produced after the ICO reviewed how personal data is used in real time bidding (RTB) in programmatic, and consulted with different industry players, identifies a series of concerning issues for the industry.
Specifically, the report mentions concerns regarding the lack of legal basis to process personal data, and potentially sensitive data, within the Real Time Bidding protocol, either through an inappropriate use of the legitimate interest (the ePrivacy directive/PECR in the UK requires consent for the use of cookies) or by using a non-valid consent. The lack of transparency, regarding the parties accessing data, or regarding enrichment and sharing of profiles greatly contributes to consent collected being non-valid. The ICO points out that the complexity of the RTB system makes it difficult for the user to understand how the processing of personal data works in the system. Finally, ICO’s report raises concerns regarding international data transfer and data leakage security issues.
Ms Elisabeth Denham, in her foreword to the report, recognises that digital advertising is here to stay. “We understand the need for a system that allows revenue for publishers and audiences for advertisers. We understand a need for the process to happen in a heartbeat. Our aim is to prompt changes that reflect this reality, but also to ensure respect for internet users’ legal rights”.
This report is a wake-up call for the part of the digital advertising industry which has not yet engaged its efforts to meet the higher standards set up by the GDPR. As part of a complex ecosystem, it is the entire industry which must act together to find solutions to comply with the rules.
The industry has to bring the necessary changes in order to avoid concentration of data in the hands of a few players, leading to so-called walled gardens. However, the driver of these changes must remain the trust of users and customers if the industry wants to be successful in the long run. In addition, to comply with the rules, self-regulation is a key tool which can help the industry develop this trust. “Accountability and transparency are two of the core principles of GDPR, as well as our own FEDMA code and DMA Code of practice. The current practices of the adtech industry are obscure and lack transparency. For the data and marketing industry to secure the trust of consumers that will ensure they’re confident sharing their data with us, we must do more to ensure transparency. We will continue to work with cross-industry groups to find solutions that strike the balance between a customer’s right to privacy and businesses’ ability to market to them.” Says Chris Combemale, CO-Chair of FEDMA.
“The ICO’s efforts to understand this particular space of digital advertising is welcomed, as well as the next steps identified in the report to engage with different stakeholders to continue the dialogue and developments in the adtech area, in particular taking into consideration industry’s effort to address these issues” says Dr. Sachiko Scheuing, Co-Chair of FEDMA. “Considering the diversity of the digital advertising industry, it is also important to distinguish the different practices and types of data used in the ecosystem, in order to identify the more privacy and consumer-friendly ways in which we can continue to provide seamless convenience for the consumer and effective promotion of European products and services”.
