The future of RTB is “in the balance,” the United Kingdom’s data protection authority said Friday.
In a blog post, the United Kingdom’s Information Commissioner’s Office (ICO) reiterated its stance that certain aspects of real-time bidding could be illegal under the General Data Protection Regulation (GDPR) – and that the Transparency and Consent Framework (TCF) might not fly under the law, either.
“We are now considering our next steps and deciding how best to address our ongoing concerns,” wrote Simon McDougall, executive director for technology and innovation at the ICO.
The blog post follows an extensive report issued by the ICO’s office in June that dug deep into the practice of RTB and the potential privacy risks associated with it.
The ICO didn’t mince words in its report, calling the ad tech ecosystem “disproportionate, intrusive and unfair” in its approach to privacy protection and “immature” in the way it appears to understand and operationalize data protection requirements.
The June report put the industry on notice, and gave ad tech companies a six-month grace period to take stock of itself and make changes to get themselves more aligned with GDPR compliance standards.
Six months later, ICO still has “significant concerns” about the processing of special category data, such as data related to political affiliation, sexual orientation and religion, and the lack of explicit consent for that processing.
The ICO also isn’t sold on whether the industry’s “reliance on contractual clauses to justify onward data sharing is sufficient to comply with the law.” In other words, the Transparency and Consent Framework, which was developed by IAB Europe in the lead-up to GDPR to help companies port consent through the supply chain, could be on shaky legal ground.
Over the last six months, the ICO has learned more about the ad tech ecosystem tick, hosting a fact-finding forum in London in November, and meeting with industry stakeholders, such as Google and IAB Europe.
The meetings were productive, but that doesn’t mean the ICO is done here. The regulator is “deciding how best to address our ongoing concerns,” McDougall wrote. Expect an update in early 2020 on the ICO’s position and any action it might plan to take.
In the meantime, the ICO advises ad tech companies to be proactive in reviewing their processes, systems and documentation, and to keep engaging with the ad trade orgs.
“Change is happening,” McDougall wrote. “Make sure you are a part of this dialogue and are engaging with your industry representation to make your views heard.”
The ICO has been clear that it wants the ad tech industry to fix its own problems rather than being forced to bring enforcement actions, although if it has to take action, it will.
