The ICO is examining data protection issues in the adtech industry and has announced a fact-finding forum in London on 6 March.
Many aspects of adtech are of interest to the ICO, as the data protection regulator, but it is currently concentrating on the world of programmatic advertising and real-time bidding. The adtech industry and its handling of personal data has also recently been in the spotlight, when the ICO and other regulators received complaints suggesting that some adtech firms were breaching the provisions of the General Data Protection Regulation.
The ICO’s initial conversations with the industry have led to the identification of three key areas of interest:
Transparency and personal data: the GDPR has clear requirements around notice and transparency. The ICO is interested in how people are told, and what people are told, about the use of their personal data for online advertising purposes when they visit websites or access apps, as well as how accurate this information is.
Lawful basis for processing personal data: the lawful bases for processing personal data that different organisations operating in the adtech ecosystem currently rely upon are apparently inconsistent. There seem to be several schools of thought around the suitability of various bases for processing personal data – the ICO would like to understand why the differences exist.
Security: Programmatic advertising depends on the rapid sharing of website or app users’ personal data, with varying levels of detail in the information being associated with the space for sale. This data may be shared very widely and quickly amongst hundreds of organisations. The ICO is interested in how organisations can have confidence and provide assurances that any onward transfers of data will be secure.
The ICO’s focus is on the challenges where personal data may be processed, and where it has regulatory oversight, that they comply with the GDPR and Data Protection Act 2018.
Next steps:
The ICO is convening a fact-finding forum on 6 March 2019 in central London. The aim is to bring together a range of representatives from across the adtech industry to explore each of the three key themes. Contact events@ico.org.uk if you would like to attend.
