On 20 June 2019 the Information Commissioner’s Office published its Update Report into Adtech and Real Time Bidding [pdf] dealing with the use of personal data the real time bidding (“RTB”) process in online advertising.

Adtech describes tools which analyse and manage information (including personal data) for online advertising campaigns.  RTB uses adtech to enable the buying and selling of advertising inventory in real time on an impression by impression basis, typically involving an auction pricing mechanism.

This process is central to what Shoshana Zuboff has called “surveillance capitalism” (see her 2019 book, The Age of Surveillance Capitalism, helpfully summarised in her 2015 paper Big other: surveillance capitalism and the prospects of an information civilization).

This process gives rise to a wide range of data protection issues which are being investigated by the ICO.

The ICO has prioritised two areas: the processing of special category data, and issues caused by relying solely on contracts for data sharing across the supply chain.

In relation to special category data, the GDPR requires explicit consent for the use of sensitive personal data to serve adverts.  The ICO has found that this is not being obtained. The ICO has found that current practices are problematic for the processing of all forms of personal data.  For example:

  • Identifying a lawful basis for processing personal data in RTB – the applicable legitimate interests are limited and methods of obtaining consent are often insufficient;
  • Privacy notices lack clarity and do not give full visibility of what happens to data.
  • The scale of the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place;
  • It is unclear whether RTB participants have fully established what data needs to be processed in order to achieve the intended outcome of targeted advertising to individuals.

In relation to the data supply chain, there is a reliance on contractual agreements to protect how bid request data is shared, secured and deleted but the ICO is of the view that this does not seem appropriate given the type of data sharing and the number of intermediaries.

The report has been widely discussed in the publications directed to the business and tech industries