On December 20, the ICO’s Executive Director for Technology and Innovation, Simon McDougall, published a blogpost entitled Adtech and the data protection debate – where next?. It marks six months since the ICO’s Update report into adtech and realtime bidding.
What does the blogpost say?
- The blogpost summarises the ICO’s engagement with the adtech industry over the past six months, including the follow-up to its Fact-Finding Forum attended by industry stakeholders.
- The ICO’s conclusion is that some of what is happening in the adtech/real-time bidding space appears to be unlawful based upon the evidence the ICO has seen to date.
- The ICO also has concerns about:
- whether reliance on contractual clauses to justify onward data sharing is sufficient to comply with the law (noting that it has not seen case studies that adequately justify this).
- the lawfulness of the processing of special category data, and the lack of explicit consent for that processing.
- The ICO is now considering its next steps and deciding how best to address its ongoing concerns. Over the coming weeks, it will be evaluating all of the options available to it.
- In the meantime, the ICO recommends that organisations educate their senior management about changes in the industry, embed a privacy-by-design approach to their use of real-time bidding and engage with their industry representation to make their views heard.
What does this mean for the adtech industry?
Although the ICO still appears to be considering its options, for now adtech players will likely breathe a sigh of relief at the conciliatory tone struck in this blogpost. The ICO appears to favour change led by the industry itself. However, the ICO has not ruled out enforcement, and will be providing a further update in early 2020 on any action it is taking.
