ICO publishes data protection & privacy expectations

In a Commissioner’s Opinion published today, the ICO recognises that since its 2019 ‘Update report into ad tech & real-time bidding’, the “industry has developed a number of initiatives that seek to address the risks ad tech poses and shift towards less intrusive tracking and profiling practices”. 

The update lays out key privacy principles and recommendations that the ICO expects any solution, proposal or initiative to meet in the future. These span user choice, accountability, data protection by design and meaningful user control. You can find the full list on pages 43-46 here. 

Outlining the remit of the Opinion - and in the context of key developments in the ad tech space such as Google’s Privacy Sandbox that is working to develop a replacement for third-party cookies - the Information Commissioner Elizabeth Denham explains: “This Opinion addresses developments since the 2019 report, including those from Google and alternatives from other sources. In general, the Commissioner’s view is that these developments are not yet sufficiently mature to assess in detail… Until they reach an appropriate level of development, the Commissioner will reserve detailed analysis and responses to specific proposals and detailed consideration of the broader impacts they may have. 

“Instead, this Opinion outlines the Commissioner’s overarching expectations that any development seeking to address the risks posed by ad tech should meet. These include expecting market participants to address the issues highlighted in the 2019 report.” 

The privacy standards state that new advertising technologies should offer people the ability to receive ads without tracking, profiling or targeting based on excessive collection of personal information. 

If people choose to share their data, the ICO states that all companies within the ad tech supply chain must ensure there is meaningful accountability and that people have control over their data. Denham adds: “My office will not accept proposals based on underlying ad tech concepts that replicate or seek to maintain the status quo.”

Since the ICO issued its 2019 report, we at the IAB have been working closely with our members to develop guidance to address real-time bidding concerns raised by the ICO and help businesses comply with their responsibilities under UK GDPR and ePrivacy legislation. The guides cover cookies and consent, special category data, data protection impact assessments and legitimate interests assessments. Find them all here. 

We welcome the clarity that the ICO’s latest Opinion provides and will continue to work with our members to communicate the core principles we laid out in January 2020 regarding viable User ID solutions. These include that “a sustainable, ad funded internet is one that is transparent on what data is being collected, how it is being used, and by whom”, as well as “giving the user control of their data and prioritising privacy”.