The U.K. Information Commissioner's Office Deputy Commissioner of Regulatory Innovation and Technology Simon McDougall, announced that after a brief suspension due to the COVID-19 global Pandemic, the regulator has now resumed its investigation into the advertising technology industry and real-time bidding.
In a January 22, 2021 Statement, Deputy Commissioner McDougall stated:
- "In May 2020, we paused our investigation into real time bidding (RTB) and the adtech industry, as we prioritised activities responding to the COVID-19 pandemic. We have now resumed our investigation.
- "Enabling transparency and protecting vulnerable citizens are priorities for the ICO. The complex system of RTB can use people's sensitive personal data to serve adverts and requires people's explicit consent, which is not happening right now.
- "Sharing people's data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data.
- "Our work will continue with a series of audits focusing on digital market platforms and we will be issuing assessment notices to specific companies in the coming months. The outcome of these audits will give us a clearer picture of the state of the industry.
- "Data broking also plays a large part in RTB and following our data broking investigation into offline direct marketing services and enforcement action for Experian in October 2020, we will be reviewing the role of data brokers in this adtech eco-system.
- "The investigation is vast and complex and, because of the sensitivity of the work, there will be times where it won't be possible to provide regular updates. However, we are committed to publishing our final findings, once the investigation is concluded.
- "All organisations operating in the adtech space should be assessing how they use personal data as a matter of urgency. We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, legitimate interests, data protection by design and data protection impact assessments (DPIAs).
- "We are also continuing to work with the Competition and Markets Authority (CMA) in considering Google's Privacy Sandbox proposals to phase out support for third party cookies on Chrome."[1]
The ICO's investigation into Adtech and RTP has been on hold since May 2020. Citing COVID-19 concerns and the desire to limit the amount of pressure on businesses during the pandemic, the ICO suspended its investigations into Adtech and RTB. However, the ICO did make it clear that "our concerns about Adtech remain and we aim to restart our work in the coming months, when the time is right."[2]
So, in light of the recent statement from Deputy Commissioner McDougall the time is apparently right to resume the investigations. As such, we will monitor the ICO's investigation of Adtech and RTB closely and advise of any new developments. In the meantime, companies are best guided to assure their compliance with GDPR guidelines are up to date, and that they are complying with any public facing privacy notices.