The Forum aimed to help ICO to better understand the privacy implications of analytics and digital tools used in the context of advertising
My best friend’s birthday was last week so I did some research in Google trying to find her favourite tennis shoes. I checked some sites to compare different models and prices and suddenly the tennis shoes where everywhere not only on my phone but also on my PC, which I did not even use to search the tennis shoes. Online newspaper articles, Instagram, travel agencies sites… Tennis shoes ads where displayed on every single webpage I visited. Can you relate? ICO Adtech Forum addressed this and other similar issues.
Adtech Fact Finding Forum was held on 6thMarch 2018 and was focused on transparency, lawful basis and security. It brought together more than a hundred of people related to adtech somehow: publishers, advertisers, civil society, start-ups, adtech firms and lawyers, who mainly discussed how people’s personal data is used in real-time bidding (RTB) in programmatic advertising.
RTB is an approach for online advertising buying and selling. Once an advertiser’s bid wins the auction, their digital real time personalised ad is instantaneously shown on the publisher’s site. This is why I bumped into tennis ads again and again.
The challenge is that this type of technology is based on the use of personal data, massive personal data normally, so how is this tackled in terms of information, lawful basis and data disclosing? Does it meet GDPR requirements? This issue raises bigger concerns as some publishers felt that participating fully in RTB was the only commercially viable option available to them currently. This situation results in a trade-off where privacy risk could be reduced by reducing the number of third-party actors involved but at the same time revenue can only be maximised by creating competition for the publisher’s advertising space. Additionally, increasing the requirements for RTB by making mandatory providing the users with a visible option for setting their preferences might imply the end of RTB as most of them would not consent.
Some of the initial conclusions stood up for increasing the control over the third-parties the data is shared with, removing or truncating some of the information in the bid request, urging unsuccessful bidders to not retain any information and making clearer the distinction between controllers and processers in the RTB ecosystem, among others. One should further highlight the likelihood of the data controller having to undertake a Data Protection Impact Assessment for many instances of RTB.
The ICO offered a window for additional written submissions to be provided following the event, limited to 1,000 words, by the end of next week (just email them toevents@ico.org.uk).
