DMA wades into ICO row over axed adtech investigation

The DMA has called on the Information Commissioner’s Office to be more consistent in its investigations if it wants to get the industry on its side to ensure meaningful change following the regulator’s decision to drop a probe into the programmatic advertising industry.

The trade body has become the first to speak out following the move, revealed by Decision Marketing last week, which has sparked the threat of legal action from two of original complainants, the Open Rights Group and University College London, which first lodged their concerns about realtime bidding back in September 2018.

The ICO has told the organisations that it had concluded its investigation into their complaint, although it insists it will be pursuing its own independent probe into how all companies collect people’s data to serve them ads.

The regulator’s letter stated that the possible data protection issues around the sector were systemic, and that it was not appropriate to single out specific companies. The ICO said: “Taking action against a small number of actors within a large and complex industry would not necessarily achieve the desired outcome of influencing change across the sector.”

However, the DMA claims this decision by the ICO has much wider implications, because other key areas of the data and marketing industry have been aggressively pursued by the ICO in recent weeks.

In October, the ICO ordered Experian to make fundamental changes to how it handles people’s personal data within its direct marketing services by issuing an enforcement notice. This followed a two-year investigation into how credit rating agencies processed and shared data within their data broking businesses for direct marketing purposes.

The DMA is now calling on the ICO to be more consistent with its enforcement policies and public announcements, as clearly two very different approaches have been implemented.

DMA director of policy and compliance John Mitchison said: “The ICO has closed one of the most publicised complaints against the programmatic advertising industry since the GDPR came into force. It has done so with seemingly no outcomes or even a public statement. This just weeks after making very public announcements about their enforcement notice to Experian, as well as issuing record-breaking fines for British Airways and Marriott International for data protection violations.

“There are clear discrepancies between how the ICO investigates and administers enforcement to different parts of the data and marketing sector. Their recent actions against a handful of credit rating agencies contradicts their statement that it would be ineffective to act against a small number of companies when it is an industry-wide issue.

“If the ICO would like to work with industry sectors to make meaningful change, as opposed to taking disciplinary action, then it must be more consistent with its policies and how investigation outcomes are communicated to the general public.”