February 18, 2019

Simon McDougall, Executive Director for Technology Policy and Innovation at the ICO, notes first that technology has completely transformed the way advertising is bought, sold and delivered. For example, many advertising techniques use people’s personal information, in the form of a personal profile, to decide which advert is delivered to them. Publishers then utilise real-time advertising methods to sell the advertising space.

Mr McDougall says that while many aspects of adtech are of interest to the ICO, as the data protection regulator, it is currently concentrating on the world of programmatic advertising and real-time bidding.

Mr McDougall notes that it is “an extremely complicated area”, with a large number of intermediaries and service providers sitting in between the advertisers buying advertising space, and the publishers selling it. The speed, scale and complexity of real-time bidding is both technologically impressive and a cause for concern, he says, but the ICO understands that at the same time this technology facilitates the sale of advertising space that generates a certain level of income for publishers, and value for advertisers.

Initial conversations with the industry has led the ICO to identify three key areas of interest:

• transparency and personal data: the GDPR has clear requirements around notice and transparency. The ICO is interested in how people are told, and what people are told, about the use of their personal data for online advertising purposes when they visit websites or access apps, as well as how accurate this information is;
• lawful basis for processing personal data: the lawful bases for processing personal data that different organisations operating in the adtech ecosystem currently rely upon are apparently inconsistent. There seem to be several schools of thought around the suitability of various bases for processing personal data and the ICO would like to understand why the differences exist; and
• security: programmatic advertising depends on the rapid sharing of website or app users’ personal data, with varying levels of detail in the information being associated with the space for sale. This data may be shared very widely and quickly amongst hundreds of organisations. The ICO is interested in how organisations can have confidence and provide assurances that any onward transfers of data will be secure.

In order to develop its understanding of all aspects of this complex ecosystem, the ICO is convening a fact-finding forum on 6 March 2019 in central London to bring together a range of representatives from across the adtech industry to explore each of the key themes.

Accordingly, the ICO will shortly be sending out invitations to people and organisations that it knows are already engaged in this debate. However, it would also welcome requests from other interested parties. To read the blog piece in full and for details on who to contact if you wish to attend the event, click here.