On January 17, 2020, the ICO published a blog post entitled “Adtech – the reform of real time bidding has started and will continue”, which provides an update on key industry changes in relation to Real Time Bidding and the ICO’s approach going forward to the issues identified in its June 2019 report.
We previously summarized the key points from the June 2019 report here, as well as an update from the ICO on this topic from December 2019 here.
What are the key developments?
- In the ICO’s view organisations that have not addressed the issues identified in its June 2019 report risk being in breach of data protection laws.
- The issues identified in the June 2019 report require both collective effort from the adtech industry to reform Real Time Bidding, as well as action from organisations individually to take responsibility for their data processing activities.
- The ICO is encouraged by industry developments and commitments it has received following its June 2019 report. The ICO intends to continue to engage with the adtech industry where the ICO thinks engagement will produce the most effective outcome for data subjects.
- Although many organisations are on board with changes that are needed, the ICO’s view is that some organisations “have their heads firmly in the sand”, and the ICO is disappointed that some organisations are “ignoring our message”.
- In the ICO’s view, justifications that have been provided to it for use of legitimate interests as the lawful basis for processing personal data in the context of Real Time Bidding are insufficient.
- The ICO’s opinion is that Data Protection Impact Assessments it has seen in relation to Real Time Bidding are generally immature, lack appropriate detail and do not follow its recommended steps to assess risks to the rights and freedoms of individuals.
- The ICO also notes it has seen examples of insufficient basic data protection controls around security, data retention and data sharing.
What will the ICO do going forward?
- Although the ICO intends to continue to engage with the adtech industry where appropriate, the ICO’s view is its engagement with the industry alone will not address all the issues.
- The ICO is using the information it has gathered as part of its industry engagement over the past year to develop its regulatory response, and will continue investigating Real Time Bidding.
- Although the ICO does not comment in detail on the likely outcome of this investigation, the ICO anticipates it will be necessary for it to take formal regulatory action in light of its view on the lack of maturity in some parts of the industry.
What should organisations do now?
- The ICO recommends organisations engage with the industry reform and transformation (and encourage their supply chain to do the same), in order to avoid regulatory scrutiny or action.
- If organisations don’t engage with these changes, the ICO has warned organisations should prepare for the ICO to use its wider powers. This could include enforcement action.
