UK data watchdog promises no regulatory changes before the New Year

It came on the back of release of a repot in June and saw it delve into whether the current processes are compliant with the General Data Protection Regulation (GDPR). It focused on specific issues such as the treatment of “special category data” – like race, sexuality and health – as well as how secure data is as it’s passed through the supply chain and the thorny issue of Legitimate Interest.

Over the period it has held two closed-door events which invited different fractions of the industry to discuss these three issues, including trade bodies, brands, adtech vendors and platforms like Google, as well as data privacy campaigners.

“What we learnt in those first few months was that it's always someone else’s fault,” revealed Simon McDougall, ICO executive director of innovation, speaking at The Drum's Programmatic Punch conference in London.

“The second event, a couple of weeks ago, was much more successful. The tone was different and there was real recognition from many in the industry that change will happen as well as detailed conversation on how the business model could be successful in the future, rather than saying ‘this is the way it's always been done’.”

In addition to these events – which McDougall said have been vital at engaging an industry not accustomed to regulation – it has also requested evidence from a variety of players in the UK adtech space.

“We asked them to share information on how their businesses work. Most of that confirmed the concerns we already had,” he said. “We didn't see anything there that changed our view on the industry.”

In particular on the subject of Legitimate Interest Assessments (LIAs), which some vendors had volunteered to share, he said most were “crap” and none gave him assurances that the data being used and shared under the guise of “legitimate interest” was appropriate.

“It’s back of a cigarette packet stuff,” he said. “We're trying to get hold of some anonymised LIAs via the IAB because we're genuinely curious. But we just haven't seen anyone make the case yet.”

It’s also started having direct conversations with advertisers. As the controllers of the purse strings, the ICO said that by putting pressure on them they will in turn put pressure on the supply chain to clean up.

“I'm not seeing advertisers push back and if in the end we as a data protection authority say the way RTB works and is illegal and not right, at what point does it become unethical for an advertiser to bankroll it? And we haven’t pushed that with advertisers yet because data processing is really happening at the other end with the publishers and the DSPs and SSPs. But as we started to push on the advertisers, we are having those conversations and that may well drive the agency side if it comes from the advertisers themselves.”

What next?

Despite the harsh assessment, McDougall stressed that he had seen the industry come together to consider a path forward and had been impressed by the level of innovation going on within certain pockets. He also expressed sympathies that it’s a hugely challenging area and change will take time.

“We get there are publishers that rely on RTB. We get there are agencies and intermediaries doing the right thing. But we need advertising that works in a productive way,” he said. “We factor those things into the thinking without taking action.”

It had set a deadline of the 20 December for the industry to have its house in order, when it would give an update on its assessment of the landscape and the subsequent steps that would be taken. Since then, concerns have mounted that it could introduce new regulation to ensure compliance with the GDPR and potentially levy heavy fines on those it found to be bad actors.

Though it has not ruled out regulatory action, McDougall made assurances it would not be “fair” to implement changes until next year.

“My focus is on moving the industry, not just stopping a couple of data controllers from doing what they're doing. In this world, that's a game of whack-a-mole,” he said.

“I'm desperate to find a way that changes the way the industry actually works. If we get agreement on lots of changes going through and we see there's some parties not following suit, then we have to find ways to move against the ones that haven't. This year and early next year we're look at what's been presented to us by the trade associations and IAB and Google and we'll go from there.

“But we won't put out any policy statements this year. [In the update] we'll acknowledge what's going on and those that have been genuinely helpful. But it will be the New Year before we talk about the next steps.”

Special Category data will be under a further spotlight

One thing is for certain though, it will be an evolving issue. On special category data, McDougall said its investigations have led to more questions about the legitimacy of the data some players are collecting.

“We're interested in things like inferred data from URLs, where it feels like publishers could do more, and other issues around generating inferences from non-special category data," he said. "For example, it we know if you have these e10 data points then we know the person has a health issue or their sexuality. So, generating special category data from non-special category data is a huge issue. We’ll be delving into that next."

McDougall was speaking at The Drum's Programmatic Punch event on Monday (2 December). You can find out more about the event and what came from it here.