In recent months the ICO has been reviewing how personal data is used in real time bidding in programmatic advertising. It has now published its Update report into adtech and real time bidding which summarises the ICO’s findings so far.
Real time bidding is a set of technologies and practices used in programmatic advertising. It has evolved and grown rapidly in recent years and is underpinned by advertising technology, allowing advertisers to compete for available digital advertising space in milliseconds, placing billions of online adverts on webpages and apps in the UK every day by automated means.
The ICO has focused on real time bidding due to its complexity, the risks it poses and the low level of data protection maturity the ICO has found in the early part of its review. It accepts that real time bidding is an innovative means of advertisement delivery. However, it also believes that in its current form, it presents a number of challenges to good data protection practices.
The ICO has prioritised two areas: (a) the processing of special category data, and (b) issues caused by relying solely on contracts for data sharing across the supply chain.
The ICO highlights that under data protection law, using people’s sensitive personal data to serve adverts requires their explicit consent, which is not currently happening. Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data.
The ICO recognises the importance of advertising to participants in this commercially sensitive ecosystem, and so has aimed to adopt a measured and iterative approach to its review of the industry as a whole so that it can observe the market’s reaction and adapt its thinking. However, the ICO says that it wants to see change in how things are done. It will continue to engage with the sector over the next six months. It says this will give the industry the chance to start making changes based on the ICO’s initial conclusions.
The ICO urges those operating in the adtech space to consider their current practices and to assess how they use personal data, taking into account the ICO’s current guidance on issues such as consent, data protection by design and data protection impact assessments.
During this time, the ICO will continue to gather information and engage with the industry to further enhance its knowledge, as well as sharing knowledge with European colleagues. It also points out that although the report concentrates on two areas of real time bidding, the ICO also has concerns about other areas of real time bidding as well as the wider adtech industry.
Towards the end of the year the ICO will review its position, consider whether its concerns still hold and evaluate whether further action is required.
