Legal action brought against ICO over alleged Adtech GDPR breaches

UK privacy campaigners The Open Rights Group (ORG) yesterday announced their intention to bring legal action against the UK data protection regulator.

The ORG claims that the Information Commissioner’s Office (ICO) has failed to stop unlawful practices by the digital advertising technology, or Adtech industry.

ORG Executive Director Jim Killock and Dr Michael Veale, a University College London academic and ORG Advisory Council member, together brought a complaint in September 2018 about the Adtech industry, particularly focusing on the role of the IAB (Internet Advertising Bureau).

A June 2019 ICO report into the GDPR and PECR compliance of “real time bidding” (RTB), in which web publishers auction advertising space to competing advertisers in milliseconds based on the data of the user viewing the page, identified a number of concerns.

These included data supply chain issues, as well as “problematic” practices for processing personal data, such as special category data, which requires consent, and what the ICO report called “disproportionate, intrusive and unfair” creation and sharing of personal data profiles in RTB.

The ICO report said it was planning a “measured and iterative approach” and would provide market participants a period of time to “adjust their practices.”

In May 2020, an ICO spokesperson said in a statement:

“The ICO recently set out its regulatory approach during the COVID-19 pandemic, where we spoke about reassessing our priorities and resources.

“Taking this into account we have made the decision to pause our investigation into real time bidding and the Adtech industry.

“It is not our intention to put undue pressure on any industry at this time but our concerns about Adtech remain and we aim to restart our work in the coming months, when the time is right.”

In August 2020, the ORG complaint was concluded by the ICO with no immediate action specified, prompting the ORG’s action.

An ICO spokesperson said: “We are aware of this matter, which will be decided by the Tribunal in due course. Consideration of concerns we have received forms part of our work on real time bidding and the Adtech industry.”

Ravi Naik, Legal Director of AWO, instructed by the complainants, said:

“Our clients simply want to the ICO to act to prevent widespread and systemic abuses of human rights; abuses that the ICO has acknowledged occur. Rather than take steps to address those problems, the ICO have acted against our clients and closed their complaints because our clients asked them to take action. This appalling state of affairs has left our clients with little option than to take the Commissioner to the Tribunal.”

 

 


Registration now OPEN for PrivSec Global
Taking place across four days from 30 Nov to 3 Dec, PrivSec Global, will be the largest data protection, privacy and security event of 2020.

Reserve your place today and gain access to the entire event free of charge. With all sessions available to view live or on-demand, you can build a personalised agenda based on your key focus topics and make the event fit around your work schedule.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.