Privacy groups have ramped up their attack on the data regulator’s continued failure to stamp out the adtech industry’s widespread abuse of personal data, after the Information Commissioner’s Office admitted it could be 2021 before its investigation into the market resumes.
The ICO first began reviewing data protection practices in the realtime bidding (RTB) sector in autumn 2018, after receiving official complaints on behalf of tech start-up Brave, the Open Rights Group and University College London.
In June last year, the ICO published its initial report into the sector, which said that the industry’s “immature” understanding of data protection is triggering the mass unlawful use of consumer data, leaving millions of users at risk of potential harm.
The report went on to set out nine “systemic concerns” the regulator has with the level of compliance of RTB, programmatic and behavioural advertising systems.
It gave the industry six months to change its practices but that deadline came and went with no enforcement, and, in January this year, the original complainants threatened legal action.
At the time, Brave chief privacy officer Johnny Ryan said: “Regulatory ambivalence cannot continue. The longer this data breach festers, the deeper the rot sets in and the further our data gets exploited. This must end. We are considering all options to put an end to the systemic breach, including direct challenges to the controllers and judicial oversight of the ICO.”
However, in May the ICO then rubbed salt into the wounds by saying it was pausing its investigation due to the Covid-19 pandemic, adding: “It is not our intention to put undue pressure on any industry at this time but our concerns about adtech remain and we aim to restart our work in the coming months, when the time is right.”
In the ICO’s annual report, published this week, the regulator admits that it could be 2021 before its investigation resumes but maintains it has already made major progress. The report states: “We have significantly raised awareness amongst the industry and media of the issues within the RTB ecosystem. The level of engagement from industry on this issue has demonstrated their appetite to address the concerns we have identified.
“In addition, we have developed a robust, evidence-based assessment of the concerns identified; articulated to data subjects and controllers, in a clear manner, the issues and expected changes; engaged with industry to help them understand how they can transform their approach; and started to develop a plan to address the inertia that still exists by considering what the appropriate regulatory response should be.”
In response, Open Rights Group executive director Jim Killock told Decision Marketing: “We are very concerned by the ICO’s seeming reluctance to use its enforcement powers to correct widespread abuses in the adtech industry. It is wholly clear to the ICO from its own work that these systemic abuses of the law exist, are taking place and will not be addressed by the minimal changes suggested by the industry.
“The ICO has powers to demand information, make assessments and to order changes. It must use these, or it is failing in its job as a regulator.”
Brave’s Johnny Ryan added: “This claim, of course, has no relation to reality. The ICO’s statement suggests that it is relying on a new found industry ‘appetite’ to address the data protection issues, shows what happens when a data protection authority employs only eight people to investigate data breaches.”
Ryan went on to claim that the issue could have far reaching repercussions, especially with the Government aiming to achieve an adequacy agreement with the EU to allow data transfers to continue once the Brexit transition period expires on December 31.
He said: “In the context of Brexit, and the need to convince the European Commission that personal data is adequately protected in the UK, the ICO’s failure could have catastrophic consequences for the UK economy in the coming years.”
ICO reveals fewer than 1% of investigations led to a fine
‘Chicken’ ICO kicks adtech investigation into long grass
ICO hunts advisors for inside track on adtech industry
Now ICO leans on brands to combat adtech data abuse
ICO faces legal challenge over failure to tackle adtech
2019 Review of the Year: Why it’s crunch time for GDPR
ICO ‘cosies up’ to industry in bid to tackle adtech issue
ICO urged to act now on adtech or be seen as soft touch
ICO: online ad industry ‘leaving millions at risk of harm’
Germans unleash GDPR blitz on behavioural ad giants
Google Ad Exchange probe threatens online ad mayhem
ICO taps up industry for probe into programmatic ads
$273bn behavioural ad industry ‘is in breach of GDPR’