What do data protection changes mean for digital advertising?

In 2021 the Department for Digital Culture, Media and Sport (DCMS) published its consultation on ‘Data Reform’ proposals to update and simplify certain aspects of the UK General Data Protection Regulation (UK GDPR) and the UK Privacy and Electronic Communications Regulations (PECR).

The IAB’s response to this consultation, submitted in December 2021, focused on three key areas 

• Cookies and consent 
• The legitimate interests legal basis 
• Reform of the ICO

The Government published its response to the consultation in June 2022 confirming its policy intentions, which will be taken forward in the Data Protection and Digital Information (DPDI) Bill, introduced to the UK Parliament in July 2022.

Does the Bill affect digital advertising? 

At the moment, it’s not completely clear how the DPDI Bill will impact digital advertising in practice - we are currently seeking more clarity from DCMS. Here is a brief explainer of what we do know, focused on the three key areas that could affect digital advertising:

• Cookies & consent 

The change in this area most likely to be relevant to digital advertising is the Government's intention to eventually remove the requirement for prior consent for all types of cookies. Its aim is to ‘improve the user experience and remove the need for unnecessary cookie consent banners’. The Bill adds new provisions to the Privacy and Electronic Communications Regulations (PECR) that create new exceptions to the consent requirement, and allow new exceptions to be made in the future.

In the short-term, the Government intends to use the Bill to “remove the need for cookie banner pop-ups on websites for low risk activities, such as audience measurement, so it’s easier for businesses to use information to improve their services.” Note that this does not appear to extend to activities such as advertising measurement. 

The Bill also paves the way for regulations to be made in the future to require providers of services such as web browsers to enable users to centrally manage their cookie consent settings, and for these to be automatically communicated to websites they visit. This provision can also apply to apps, connected devices, etc. This appears to be longer-term plan, and the Government says that it will only make these changes “once automated technology is widely available to help users manage online preferences.” It is not clear what form this technology will take, or how the Government envisages cookie consent management tools being developed. 

Our position at the IAB is that changes in this area aren’t straightforward and will need to be developed carefully, and with proper industry involvement, and a proper assessment of the likely practical, legal, economic and competition implications for the digital advertising sector. While annoying, cookie banners have a legitimate function in enabling data controllers to record and demonstrate that they have met their transparency and consent obligations under the law, which needs to be taken into account in developing possible alternative approaches and balanced against the desire to improve people’s online experience. It is also crucial that any changes do not undermine the provision of ad-funded content and services. We will be raising these issues with DCMS as it takes this policy forward.

• Legitimate interests legal basis

The intention of the Government's policy in this area is to create a limited list of legitimate interests for businesses to process personal data without applying the balancing test - whereby the interests of the party processing the data are weighed against the interests of the person whose data it is. 

The DPDI Bill introduces a concept of a  ‘recognised legitimate interest’, which would be a new lawful basis for processing personal data under the UK GDPR, and includes an exhaustive list of recognised legitimate interests. This list can be changed in the future. Areas selected on the current list  have a focus on ‘public interests’ - such as detecting, investigating or preventing crime, including economic crime such as fraud - which could potentially provide a basis for disclosing data to regulators or law enforcement bodies in relation to advertising-related fraud. Beyond this, there are no advertising-related ‘recognised activities’ currently included on the list. 

• Changes to the ICO 

The Bill makes a number of changes to the Information Commissioner’s Office (ICO). The ICO will become the Information Commission and the Bill provides for a transfer of functions from the current to the new organisation. Other relevant changes include: 

• A statutory framework setting out the ICO’s strategic objectives and duties  
• An overarching duty for the ICO to uphold data rights and encourage trustworthy and responsible data use 
• New duties for the ICO to have regard for economic growth and innovation, have regard to competition issues, and consult with relevant regulators and any other relevant bodies when exercising its duties to have regard to growth, innovation and competition 
• Establishing an independent board and chief executive for the ICO 

The ICO’s remit is increasingly important for competition, innovation and economic growth and we welcome the proposed new duties for the ICO to explicitly consider these impacts in its work, and to bring more transparency to how it does so. We also welcome the focus on supporting regulatory cooperation. 

Once we have more clarity on the above changes, we will update IAB members and please contact [email protected] if you have any questions in the meantime.