Govt urged to beef up data bill to fight 'horrific' adtech

As the data reform bill returns to Parliament, the Government is facing fresh calls to tighten up the legislation – especially over the adtech industry’s handling of personal data – amid claims that the “current landscape for data protection is not working”.

A new report by leading cross-party think-tank Demos, published to coincide with today’s second reading of the Data Protection & Digital Information (No. 2) Bill, maintains it is “near-impossible to grasp” how much data is being collected about consumers online.

The study followed five anonymous volunteers, aged 22 to 66, as they tried to find out how much data was held on them by companies online.

One participant said they felt “scared” and “concerned” about the level of data held by them by some companies, while another was “horrified” at the assumptions made about them through their data.

Social media sites were among the biggest culprits, with one volunteer finding that 2,242 companies potentially had access to their data for advertising purposes through Facebook.

Searches of their email histories also found that between 72 and 231 companies were storing their personal data at any one time.

The data held by companies ranges from how users interact with certain sites, to their location information, financial histories, shopping habits and personal preferences, and were often available to third-party advertisers.

The report found some companies, including Experian, use anonymised financial data to build “profiles”, which are then sold to companies to help them target particular groups of customers. In fact, Experian is currently embroiled in legal action with the Information Commissioner’s Office over whether its data collection policies are in breach of current legislation.

A similar practice is also undertaken by Amazon, which creates “audience sets” grouping users into categories based on their interests, which can then be used by advertisers on the site.

The volunteers found that getting companies to delete this data was “complicated, time-consuming and has no guarantee of success” – one volunteer had 65% of their data deletion requests responded to, while for others the figure was only 10%.

Demos said there needs to be “stronger” enforcement mechanisms for privacy violations, public education campaigns on digital literacy and new standards for how sites use user data.

The report stated: “Individuals are unable to control their data or give meaningful consent to how it is used, and do not know the extent of what is being collected, while the purposes it is used for remain opaque.”

The think-tank added that it was “clear the current landscape for data protection is not working” and that businesses and regulators “need to take seriously their responsibility” to ensure data privacy.

It urged the Government to use the Data Protection & Digital Information (No. 2) Bill, as well as the Digital Markets Bill, to toughen up data protection, and launch public education campaigns to promote understanding of digital privacy.

Demos’ report follows mounting criticism of the Bill, which some privacy groups already claiming it will actually weaken consumers’ data rights and water down accountability; others have rubbished Government reports that the reforms will save the UK economy £4.7bn over ten years.

However, the DMA – which was involved in consultations to amend the proposals – insists the new legislation will have major benefits for the data-driven marketing industry, especially around legitimate interest and charity activity.

In response to the second reading, Advertising Association director of policy research Konrad Shek said: “Today’s debate in the Commons marks an important milestone for the Data Protection & Digital Information Bill. We are pleased with the progress, particularly on the additional clarity provided on the use of legitimate interest, especially with regard to direct marketing; the inclusion of commercial research under research provisions; and reduction of overall paper requirements for SMEs.

“However, we believe there is still more to be done and, as the Bill progresses through Parliament, we will seek all available opportunity to make progress on our priority issues within that framework.

“This includes, for example, resolving legacy legal issues from the current data protection regime concerning low-risk cookies that are utilised in audience measurement and ad performance – an important component of the advertising supply chain that supports the funding of publishers and other content producers online. This, we believe, would go some way towards helping the Government achieve its stated goal of enabling organisations to grow and innovate whilst maintaining high standards of data protection rights.

“Advertising and marketing are critical to the economy. They fuel economic growth, drive product innovation, and play a crucial role in brand competition. But importantly, data privacy is at the heart of our members’ activities, as they see privacy and consumer trust as intrinsically linked. This is why the advertising and marketing industry has invested heavily in complying with data protection regulations.”