‘Prepare for ICO to utilise its wider powers’: UK regulator issues warning to adtech
The UK's data regulator, the Information Commissioner's Office (ICO), has issued a warning to any adtech companies which have failed to “use the window of opportunity to engage and transform” their practices - it’s coming for them.
ICO updates adtech industry
The ICO’s update on its investigation into the adtech sector came from the watchdog’s executive director for technology and innovation Simon McDougall, who has led a six-month consultation into the practices around adtech and real-time bidding (RTB) following the implementation of the General Data Protection Regulation (GDPR).
He focused on specific issues such as the treatment of “special category data” – like race, sexuality and health – as well as how secure data is as it’s passed through the supply chain and the thorny issue of Legitimate Interest.
In a blog post today (17 January) he stated the ICO had been left “disappointed that there are some who are still ignoring our message” after it gave the adtech industry the better part of a year to collectively reform their RTB processes.
“While many organisations are on board with the changes that need making, some appear to have their heads firmly in the sand. It is now clear to us that engagement alone will not address all these issues,” McDougall said.
“For instance, we have reviewed a number of justifications for the use of legitimate interests as the lawful basis for the processing of personal data in RTB. Our current view is that the justification offered by organisations is insufficient.”
He added that the Data Protection Impact Assessments it has seen “have been generally immature, lack appropriate detail, and do not follow the ICO’s recommended steps to assess the risk to the rights and freedoms of the individual” while it has also seen examples of “basic data protection controls around security, data retention and data sharing being insufficient.”
However, he applauded the Interactive Advertising Bureau (IAB) UK on guidance it is developing to educate the industry on special category data and cookie requirements which the ICO will continue to collaborate on to ensure the proposals “are executed in a timely manner.”
The update also pointed to Google’s decision to remove content categories and its plan to phase out third-party cookies on Chrome, which the tech giant announced this week. “We are encouraged by this and will continue to look at the changes Google has proposed,” McDougall said, despite a number of trade bodies voicing concerns the move "may choke off the economic oxygen from advertising that startups and emerging companies need to survive."
The ICO ended with a strict warning to any adtech firms that continue to flout rules and push the boundaries of acceptable data use, stating that it is now using the intelligence gathered over the past seven months into RTB to inform an “appropriate regulatory response.”
“While it is too soon to speculate on the outcome of that investigation, given our understanding of the lack of maturity in some parts of this industry we anticipate it may be necessary to take formal regulatory action and will continue to progress our work on that basis,” McDougall said.
“Those who have ignored the window of opportunity to engage and transform must now prepare for the ICO to utilise its wider powers.”
Responding to the update, Christie Dennehy-Neil, head of policy and regulatory affairs at IAB UK said: “This has been a constructive process and we are pleased that the ICO has recognised the work that the industry has done to date, and the value of the further work we’ve committed to.
“We have made good progress, but what matters now is the outcome. Implementing the actions outlined in our response to the ICO needs our members and the wider industry to work with us and be willing to take action where necessary to deliver meaningful change. We look forward to continuing to engage with the ICO as this process develops.”
You can read Simon McDougall's update in The Drum here.