20 June 2019
By Simon McDougall, Executive Director for Technology and Innovation
In recent months we’ve been reviewing how personal data is used in real time bidding (RTB) in programmatic advertising, engaging with key stakeholders directly and via our fact-finding forum event to understand the views and concerns of those involved.
Today we’re publishing our Update report into adtech and real time bidding which summarises our findings so far.
We have focused on RTB due to its complexity, the risks it poses and the low level of data protection maturity we’ve found through some of our initial engagement. Whilst we accept that RTB is an innovative means of advertisement delivery, our view is that, in its current form, it presents a number of challenges to good data protection practices.
We have prioritised two areas: the processing of special category data, and issues caused by relying solely on contracts for data sharing across the supply chain. Under data protection law, using people’s sensitive personal data to serve adverts requires their explicit consent, which is not happening right now. Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data.
We recognise the importance of advertising to participants in this commercially sensitive ecosystem, and have purposely adopted a measured and iterative approach to our review of the industry as a whole so that we can observe the market’s reaction and adapt our thinking. However, we want to see change in how things are done. We’ll be spending the next six months continuing to engage with the sector, which will give the industry the chance to start making changes based on the conclusions we’ve come to so far.
If you operate in the adtech space, it’s time to look at what you’re doing now, and to assess how you use personal data. We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, data protection by design and data protection impact assessments (DPIAs).
During this time we will continue to gather information and engage with the industry to further enhance our knowledge. We’ll also continue to share knowledge with our European colleagues. It is worth noting that whilst the report concentrates on two areas of RTB, it doesn’t indicate that we don’t have concerns about the rest of RTB, or indeed the wider adtech industry.
This is a dynamic debate and we look forward to continuing our engagement in this area. Towards the end of the year we will review our position, consider whether our concerns still hold and evaluate whether further action is required.
 |
Simon McDougall is Executive Director for Technology Policy and Innovation at the ICO where he is developing an approach to addressing new technological and online harms. He is particularly focused on artificial intelligence and data ethics. He is also responsible for the development of a framework for auditing the use of personal data in machine learning algorithms. |
