ICO To Restart Adtech Probe

The Information Commissioner’s Office (ICO) said it is to resume its probe into the UK’s ££13 billion advertising technology sector, following an eight-month suspension due to the pandemic.

The investigation was announced in January of last year, after the ICO said it found evidence of widespread non-compliance with the EU’s General Data Protection Regulation (GDPR), which is also enforced in UK law.

The probe was then put on hold in May, with the regulator saying it was reluctant to place “undue pressure on any industry at this time” due to Covid-19.

It added at the time that “concerns about adtech remain and we aim to restart our work in the coming months”.

Real-time bidding

One of the elements the ICO is to focus on is real-time bidding (RTB), which involves buying and selling advertising inventory in real time and trading in personal data for ad-targeting purposes.

The ICO said companies involved in RTB did not appear to be complying with GDPR protections on the commercial use of personal information.

“The complex system of RTB can use people’s sensitive personal data to serve adverts and requires people’s explicit consent, which is not happening right now,” said ICO deputy commissioner Simon McDougall.

“Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data.”

He said the ICO would carry out a series of audits focusing on digital marketing platforms, with assessment notices being issued to specific companies “in the coming months”.

The ICO said it believes the audits will give it a clearer picture of the current state of the industry.

Data brokers

The regulator is also to look into the role of data brokers.

This aspect of the probe follows an investigation into offline direct marketing services that resulted in an October 2020 enforcement action against credit reference agency Experian and others.

“All organisations operating in the adtech space should be assessing how they use personal data as a matter of urgency,” McDougall said.

“We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, legitimate interests, data protection by design and data protection impact assessments.”

McDougall said the ICO is working with the Competition and Markets Authority in considering Google’s Privacy Sandbox proposals, which would phase out support for third-party cookies in the Chrome browser.

Enforcement risk

The plan, announced by Google in January 2020, would oblige advertisers to access user data via Google’s own Privacy Sandbox browser technology.

Mark Thompson, global lead at KPMG’s Privacy Advisory practice, said the ICO’s statement should put firms on notice that the way they handle users’ personal information could put them at risk.

“Organisations now need to understand their risk exposure to the issues identified by the ICO – namely, whether they know what personal data they share with the ecosystem and the data protection laws that apply, how transparent they have been with their users and scrutinising their understanding of their supply chain risk,” Thompson said.

He advised organisations to look at the actions taken following recent ICO audits, as these can become enforcement notices requiring costly changes to fix problems at short notice.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Meta Building Fastest AI Supercomputer In The World

Facebook building the world’s fastest AI supercomputer to help detect and moderate offensive posts and…

2 hours ago

Nvidia Preparing To Abandon $40bn ARM Acquisition – Report

Facing many regulatory probes and lawsuits, Nvidia tells its partners it is preparing to abandon…

4 hours ago

Vodafone To Switch Off 3G Network Next Year

Mobile operators press ahead with early retirement of old networks, as Vodafone sets 2023 deadline…

5 hours ago

Online Safety Bill Is A ‘Missed Opportunity,’ MPs Warn

DCMS committee says draft version of landmark online safety bill is not robust or clear…

7 hours ago

Julian Assange Wins Right To Ask Supreme Court For Extradition Appeal

Another twist. Julian Assange wins right to ask UK's Supreme Court if it will hear…

7 hours ago

ICO Disagrees With Government-Backed Encryption Campaign

UK data protection watchdog, the ICO, says encryption provides protections for children, after government-backed campaign…

8 hours ago