The Information Commissioner’s Office has put the data broking industry on red alert after reopening its adtech investigation, some eight months after slamming on the brakes and claiming it did not want to put “undue pressure on any industry” during the coronavirus pandemic.
The regulator said that following its data broking investigation into offline direct marketing services and enforcement action against Experian late last year, it will be closely studying the role data brokers play in the adtech industry.
ICO deputy commissioner for regulatory innovation and technology Simon McDougall said that enabling transparency and protecting vulnerable citizens are “priorities for the ICO”, adding that the complex system of realtime bidding can use people’s sensitive personal data to serve adverts and requires people’s explicit consent, “which is not happening right now”.
McDougall added: “Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data.
“Our work will continue with a series of audits focusing on digital market platforms and we will be issuing assessment notices to specific companies in the coming months. The outcome of these audits will give us a clearer picture of the state of the industry.
“The investigation is vast and complex and, because of the sensitivity of the work, there will be times where it won’t be possible to provide regular updates. However, we are committed to publishing our final findings, once the investigation is concluded.
“Data broking also plays a large part in RTB and following our data broking investigation into offline direct marketing services and enforcement action for Experian in October 2020, we will be reviewing the role of data brokers in this adtech eco-system.
“All organisations operating in the adtech space should be assessing how they use personal data as a matter of urgency. We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, legitimate interests, data protection by design and data protection impact assessments (DPIAs).
“We are also continuing to work with the Competition & Markets Authority (CMA) in considering Google’s Privacy Sandbox proposals to phase out support for third party cookies on Chrome.”
Privacy groups, which were highly critical when the ICO announced the delay, have yet to comment on the move.
Related stories
DMA wades into ICO row over axed adtech investigation
Experian lawyers set for long battle against ICO ruling
Experian given ultimatum to delete dodgy data or else
Adtech breach widens, two years after first complaints
Privacy groups hit out at fresh delay to adtech probe
‘Chicken’ ICO kicks adtech investigation into long grass
ICO ‘cosies up’ to industry in bid to tackle adtech issue
$273bn behavioural ad industry ‘is in breach of GDPR’
