'Chicken' ICO kicks adtech investigation into long grass

The Information Commissioner’s Office has been accused of chickening out of its investigation into the real-time bidding and adtech industry, after the regulator insisted it did not want to put “undue pressure” on the sector during the Covid-19 pandemic.

The decision has been greeted with dismay by some data protection campaigners, although others have seen it coming for months. It follows the ICO’s announcement that it will show greater leniency to all firms during the outbreak, carry out fewer investigations and slash fines. All appeals have also been suspended.

In a statement, the regulator said: “The ICO recently set out its regulatory approach during the Covid-19 pandemic, where we spoke about reassessing our priorities and resources.

“Taking this into account we have made the decision to pause our investigation into real time bidding and the adtech industry.

“It is not our intention to put undue pressure on any industry at this time but our concerns about adtech remain and we aim to restart our work in the coming months, when the time is right.”

Johnny Ryan, the chief policy officer at Brave – one of the organisations that lodged the first GDPR complaints about real-time bidding (RTB) back in September 2018 – branded the latest move “astounding”.

Ryan, who has already threatened to push for a judicial review of the ICO due to its inability to act, told TechCrunch: “They’ve failed to use any of their statutory powers, including statutory powers of investigation. We’re not even talking about enforcement. The lack of action is quite astounding.

“I claim it’s the biggest data breach the UK has ever had – and I’ve never heard anyone contradict that. This enormous breach continues every day. The vast RTB data breach is not a discrete event that is now over. The harm is constantly accumulating.”

Ryan claims that despite being the biggest data regulator in Europe, with a budget of £50m and 680 staff, the ICO does not seem to be fit for purpose. And in a report published late last month, Brave revealed that only 3% of the ICO’s staff (21 people) work on tech privacy problems.

Other data industry experts have seen this coming for months, ever since the ICO missed its first deadline for action, having given the adtech industry six months to get its house in order.

One insider said: “The ICO talks a good game but once again it has chickened out of the big decision. Everyone was hailing it as a tough regulator when it announced the intended fines on British Airways and Marriott International, but they don’t look likely now either. Just what are they doing up in Wilmslow?”

Ryan points out that kicking the investigation into the long grass will also harm the UK’s chances of securing a post-Brexit adequacy decision.

When the UK leaves the EU, firms will still be able to transfer data to European companies but, as a “third country”, EU businesses would not be allowed to send data back to the UK. They will be able to use “standard contract clauses” (SCCs) to transfer personal data but an adequacy deal is far simpler.

Ryan explained: “When the UK requests that the European Commission consider the UK as a safe and adequate third country where personal data from the EU can freely flow, one of the questions to be considered is: Do you have a regulator that can protect this personal data? The answer today is ‘no’.

“The UK does not have a regulator that is able to protect personal data of European citizens. The ICO’s inaction will have a post-Brexit implication. It will affect so many sectors of the UK economy.”