ICO resumes real-time bidding and adtech probe

“Enabling transparency and protecting vulnerable citizens are priorities for the ICO,” said Simon McDougall, deputy commissioner (regulatory innovation and technology).

“The complex system of RTB can use people’s sensitive personal data to serve adverts and requires people’s explicit consent, which is not happening right now.

“Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data.”

The ICO will conduct a series of audits focusing on digital market platforms and issue assessment notices to specific companies in the coming months. “The outcome of these audits will give us a clearer picture of the state of the industry,” said McDougall.

As data broking plays a large part in RTB, the privacy watchdog will also review the role of data brokers in the adtech eco-system, he added.

McDougall cautioned: “The investigation is vast and complex and, because of the sensitivity of the work, there will be times where it won’t be possible to provide regular updates.

However, we are committed to publishing our final findings, once the investigation is concluded.”

He also said: “All organisations operating in the adtech space should be assessing how they use personal data as a matter of urgency.

“We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, legitimate interests, data protection by design and data protection impact assessments.”