June 24, 2019

The ICO has been reviewing how personal data is used in real time bidding (RTB) in programmatic advertising. It has now published its update report into adtech and real time bidding, which summarises the findings so far.

The ICO explains that it has focused on RTB due to its complexity, the risks it poses and the low level of data protection maturity the regulator has found through some of its initial engagement. The ICO accepts that RTB is an innovative means of advertisement delivery, but its view is that in its current form it presents a number of challenges to good data protection practices.

The ICO says that it has prioritised two areas: the processing of special category data, and issues caused by relying solely on contracts for data sharing across the supply chain. The ICO says that at the moment, explicit consent is not being obtained for the use of people’s sensitive personal data. There are also questions around the security and retention of this data.

The ICO says that it recognises the importance of advertising to participants in this commercially sensitive ecosystem, and has “purposely adopted a measured and iterative approach to our review of the industry as a whole so that we can observe the market’s reaction and adapt our thinking”. However, it wants to see change in how things are done. Therefore, it will be spending the next six months continuing to engage with the sector.

The ICO is encouraging those operating in the adtech space to look at what they are doing now and to assess how they use personal data.

The ICO says it will continue to gather information and engage with the industry to further enhance its knowledge. It will also continue to share knowledge with its European colleagues. The ICO notes that whilst the report concentrates on two areas of RTB, it does not indicate that the regulator does not have concerns about the rest of RTB, or indeed the wider adtech industry.

Towards the end of the year, the ICO says it will review its position, consider whether its concerns still hold and evaluate whether further action is required. To read the ICO’s blog post in full, click here.