The ICO has responded to a complaint brought by Jim Killock and Dr Michael Veale in Europe’s €12 billion real-time bidding adtech industry. Killock and Veale are now calling on the ICO to take action against companies that are processing data unlawfully.
The ICO has agreed in substance with the complainants’ points about the insecurity of adtech data sharing. In particular, the ICO states that:
“Processing of non-special category data is taking place unlawfully at the point of collection”
“[The ICO has] little confidence that the risks associated with RTB have been fully assessed and mitigated”
“Individuals have no guarantees about the security of their personal data within the ecosystem”
However the ICO is proceeding very cautiously and slowly, and not insisting on immediate changes, despite the massive scale of the data breach.
Jim Killock said:
“The ICO’s conclusions are strong and very welcome but we are worried about the slow pace of action and investigation. The ICO has confirmed massive illegality on behalf of the adtech industry. They should be insisting on remedies and fast.”
Dr Michael Veale said:
“The ICO has clearly indicated that the sector operates outside the law, and that there is no evidence the industry will correct itself voluntarily. As long as it remains doing so, it undermines the operation and the credibility of the GDPR in all other sectors. Action, not words, will make a difference—and the ICO needs to act now.”
Ravi Naik, solicitor for the complaints and for Dr Johnny Ryan’s simultaneous complaint before the Irish DPC, said:
“Between the ICO’s report and the actions of the DPC, there can no longer be any question; AdTech cannot comply with the GDPR. We welcome the ICO’s findings and look forward to the Commissioner taking concrete steps to prevent further violations of individual rights. It is time for action.”
For more information and interviews, contact firstname.lastname@example.org, 07749 785 932.
Notes to Editors
The ICO Report is available here:
The ICO concludes:
Overall, in the ICO’s view the adtech industry appears immature in its understanding of data protection requirements. Whilst the automated delivery of ad impressions is here to stay, we have general, systemic concerns around the level of compliance of RTB:
FixAdTech campaign website https://fixad.tech/about/ includes the complaints and details of other complaints made across the EU.
The complaints are being made by Dr Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Dr Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), Jose Belo (Exigo Luxembourg), Katarzyna Szymielewicz, President of the Panoptykon Foundation, Jim Killock, Executive Director of the Open Rights Group, Dr Michael Veale of University College London, and Dr Johnny Ryan of Brave, the private web browser. The complainants in Ireland and in the UK have instructed Ravi Naik, Partner at ITN Solicitors.