ICO claims AdTech industry 'violating data protection laws'

Privacy group welcomes the ICO report but accuses the regulator of proceeding slowly on "massive illegality"

A graphic of individuals engaging with online ads

The online advertising industry is operating unlawfully with respect to strict data protection regulations and has an "immature" understanding of its obligations, the Information Commissioner's Office (ICO) has claimed.

The multi-billion pound AdTech industry, which is overwhelmingly dominated by Google and Facebook, is not gaining consent from users when processing personal data that includes information on sexuality, political leaning, or race, among others.

This represents a violation of standards set under the General Data Protection Regulation (GDPR), and the UK's Data Protection Act (DPA) 2018, according to a report published by the UK data regulator.

The companies are doing this through a mechanism known as real-time bidding (RTB). This set of technologies allow advertisers to compete for available digital space by automatically placing billions of ads on webpages and apps in the UK every day.

Processing non-special category data, too, risks violating the Privacy and Electronic Communications Regulations (PECR). Although handling this sort of data doesn't normally require consent, the industry's use of cookies to process information means consent is still needed at the initial point of processing.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"Under data protection law, using people's sensitive personal data to serve adverts requires their explicit consent, which is not happening right now," said the ICO's executive director for technology policy and innovation Simon McDougall.

"Sharing people's data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data."

The privacy-centric organisation Open Rights Group (ORG), which initially co-authored the complaint that spurred the ICO to investigate the issue, welcomed the report. But the group added the regulator is proceeding slowly and not insisting on immediate changes "despite the massive scale of the data breach".

"The ICO's conclusions are strong and very welcome but we are worried about the slow pace of action and investigation," said the ORG's executive director Jim Killock. "The ICO has confirmed massive illegality on behalf of the adtech industry. They should be insisting on remedies and fast."

The data regulator highlighted a number of additional concerns around data protection laws and RTB. For example, the ICO has seen no evidence that requirements under GDPR to conduct data protection impact assessments (DPIA) are being recognised by companies involved in this mechanism.

Advertisement - Article continues below

This means the personal data risks associated with RTB have not likely been understood and mitigated. Moreover, the profiles created about individuals are highly details and repeatedly shared among hundreds of organisations without their knowledge or consent.

The ICO will continue to gather more information and engage with the AdTech industry, McDougall added, to enhance its knowledge, and share this with European regulators.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/backup/33385/arcserve-udp-9240dr-review-beef-up-your-backups
backup

Arcserve UDP 9240DR review: Beef up your backups

4 Apr 2019

Most Popular

Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/business/business-strategy/354304/ex-apple-cpu-architect-accuses-the-firm-of-invading-privacy
Business strategy

Ex-Apple CPU architect accuses the firm of invading privacy

10 Dec 2019
Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019