The UK Information Commissioner’s Office (ICO) has questions about the legality of certain parts of the programmatic ecosystem and says that “the future of RTB is…in the balance”.
In a post published Friday, Simon McDougall, the ICO’s executive director for technology and innovation, explained that as the ICO’s understanding of the adtech industry has developed, it now has “significant concerns about the lawfulness of the processing of special category data which we’ve seen in the industry, and the lack of explicit consent for that processing.”
Under the GDPR, special category data is data that demands more protection because it is sensitive in nature. Information about health, political and religious affiliations, and race is among that considered to be special category data.
According to the ICO, companies must possess a basis for processing special category data under Article 6 of the GDPR. In addition, they must meet at least one of the conditions described in Article 9 of the GDRP.
Companies that do not have no lawful basis for processing special category data and McDougall’s post suggests that the ICO believes unlawful processing is rampant in the industry. Additionally, McDougall says “we also have concerns about whether reliance on contractual clauses to justify onward data sharing is sufficient to comply with the law. We have not seen case studies that appear to adequately justify this.”
Hence the statement about the future of RTB being “in the balance”, which is especially interesting in light of GDPR complaints filed by Brendan Eich, the CEO of privacy-focused browser Brave, who alleges that Google’s RTB system is violating the GDPR.
So what happens next?
McDougall advises companies involved in the RTB ecosystem to make senior management aware of the fact that practices are changing in the industry and to embrace privacy by design in their RTB activities. Reading between the lines, it appears that the ICO prefers for the industry to change from within. Indeed, McDougall noted that the ICO is reviewing “really important statements of intent from Google and IAB UK” and suggested that companies engage trade associations that are supposed to represent their interests.
At the same time, the ICO’s GDPR enforcement actions, which include a fine of £183m levied against British Airways, demonstrate that the agency is willing to exercise its authority when it deems necessary. With this in mind, one might interpret McDougall’s post as a warning to the industry: figure out how to comply with the law or the ICO will figure it out for you.
GDPR: A year on
Will digital advertising be the same after 2020?
The ICO’s concerns about RTB highlight what is perhaps the biggest trend that will drive change: the widespread belief that the industry does not respect the privacy of consumers and is doing whatever it wants with their data.
Between GDPR-related developments like the ICO’s RTB statement, the continued crackdown on cookies, the implementation of the CCPA in California, and the ongoing antitrust investigations of Big Tech by US and European regulators, 2020 is shaping up to be a very important year for the digital ad industry, one in which the direction of the industry could shift in big ways.
While industry participants, including advertisers, cannot precisely predict the future, it’s not too early for them to accept that privacy and data rights concerns aren’t going away and to ensure that as they enter 2020, they’re positioned for changes that will by and large favor consumers.
