Data watchdog says behavioural advertising is breaking law
The U.K. data watchdog has issued a report highlighting how ad tech companies and publishers involved in real-time bidding are breaching GDPR rules – and how they need to comply (Digiday).
Key points:
- ‘Legitimate interest’ cannot apply to the data being collected and used within RTB
- Any processing of special category data (health, sexuality, ethnic background etc.) without explicit consent is unlawful
- Industry’s approach to standard contracts around data processing ‘does not satisfy the requirements of data protection legislation’
- Flaws in the IAB’s Transparency and Consent Framework and Google’s Authorised Buyers network mean they need to be changed to comply with GDPR
- Information Commissioner’s Office (ICO) says it is working with other European regulators looking into RTB data issues
Real-time bidding is breaching all sorts of data laws, according the ICO report. That has ramifications for everyone in the supply chain.
Legitimate interest is no defence for data processing without explicit consent, while “any processing of special category data is taking place unlawfully as explicit consent is not being collected”, it states.
The standard contractual arrangements industry has been using to de-risk data partnerships are no good – companies have to check everything they are doing is data protection compliant.
The ICO said it will now dig further into the ad data supply chain. Depending on what it finds, it may conduct an 'industry sweep' in six months' time. But within the report, there is one line that clearly spells out the direction of travel:
“The creation of these very detailed profiles, which are repeatedly augmented with information about actions that individuals take on the web, is disproportionate, intrusive and unfair in the context of the processing of personal data for the purposes of delivering targeted advertising.”
Tech Crunch describes the ruling as potentially a 'knock-out blow for highly invasive data-driven ads'.
