ICO resumes investigation into Adtech

On 22 January 2021 the ICO announced that it was resuming its investigation into the AdTech sector.

In May 2020, the ICO paused its investigation into real time bidding (RTB) and the AdTech industry, as they prioritised activities responding to Covid-19. The ICO have now resumed the investigation.

The ICO has said that the complex system of RTB uses people’s sensitive personal data to serve adverts and requires explicit consent, which is not happening right now. Sharing data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data.

The ICO’s initial views were that RTB is unlawful. It can be expected that the ICO will issue assessment notices to specific companies in the coming months.  Key issues have been:

• The ICO’s initial view that the use of “legitimate interests” as the lawful basis for the processing of personal data in RTB is insufficient.
• Concern about the lawfulness of the processing of special category data, and the lack of explicit consent for that processing.
• Concern about relying on contracts for data sharing across the supply chain.
• Data Protection Impact Assessments not following the ICO’s recommended steps to assess the risk to the rights and freedoms of the individual
• Basic data protection controls around security, data retention and data sharing being insufficient.

The ICO has emphasised that the most effective way for organisations to avoid the need for regulatory scrutiny or action is to engage with the industry reform and transformation, and to encourage their supply chain to do the same.

 We can expect more compliance-challenging developments in this space in the coming months.

Contact us

If you have any questions about these issues in relation to your own organisation, please contact a member of the team or speak with your usual Fox Williams contact.