ICO: the future of RTB ‘in the balance’
Following a six month consultation into the programmatic market’s compliance with current data legislation, the Information Commissioner’s Office (ICO) has made the early conclusion that parts of the sector are acting unlawfully.
The ICO’s initial findings, which come after a review into how real time bidding (RTB) on the open programmatic market complies with GDPR, is a stark warning to adtech businesses, which face substantial fines if they do not change.
“The future of RTB is both in the balance and in the hands of all the organisations involved,” said Simon McDougall, the ICO’s executive director for technology and innovation, on Friday (Dec 20).
“We have significant concerns about the lawfulness of the processing of special category data which we’ve seen in the industry, and the lack of explicit consent for that processing.”
McDougall added that the ICO, which will issue its full conclusions and recommendations early next year, also has concerns about whether reliance on contractual clauses to justify onward data sharing is sufficient to comply with the law.
“We have not seen case studies that appear to adequately justify this,” he said.
In June the ICO issued the Adtech Update Report, giving the programmatic industry six months to read, debate and act upon its early recommendations and concerns. The view from the outset was that it was an “industry problem requiring an industry solution”. [advert position=”left”]
Most of the concerns relate to how personal data is used for a large proportion of online advertising activity, with a particular concern over sensitive data related to sexuality, health and religion.
The view of the ICO is that vast swathes of the market are not meeting compliance with the 2018 General Data Protection Regulation (GDPR), and thus operating illegally.
However, given the nebulous and complex supply chains in operation, the entire industry – from the brands bankrolling it to the publishers hosting the working media, and the myriad adtech vendors in between – have been given a grace period in which to adapt and change.
When the ICO first issued its warnings, the body representing online advertising, IAB UK, called for its members to review how they use personal data when trading and delivering online advertising.
That review culminated last month with a closed-door event with key players in the adtech market, which is understood to have reached a broad consensus that real-time bidding needed to change.
“We heard some really important statements of intent from Google and IAB UK and we are working to understand the exact nature of the proposals and see how they will work in practice,” said McDougall.
“The discussion has evolved from ‘it’s too complicated’ to practical consideration of potential solutions that combine innovation and privacy.”
The ICO said it will now evaluate all of the options available to it over the coming weeks and will be providing a further update in early 2020 on its position and on any action it is taking.
Responding to Friday’s news, the IAB issued a lengthy response outlining the actions its members have committed to take, and identified areas where it believes further discussion is needed before a clearer position and consensus can be reached.