IAB UK GDPR checklist

 

(Last updated 1 May 2018) 

Ever since the European Commission first drew up plans for an update to Europe’s data protection rules, we’ve aimed to help members understand what the new law means to their businesses and provide guidance where possible. 

Offering a helping hand to advise businesses what processes to put in place to help them comply with the GDPR has been a challenging task. The GDPR is no stranger to ambiguity and littered with grey areas that could have far reaching consequences for our industry. We first proposed ‘five things to consider now’ in our members briefing which we published in the wake of IAB Engage back in October 2016 but understand that as the deadline approaches, further industry guidance is increasingly important. The good news is that things are slowly starting to become clearer. 

As such, you can find our GDPR checklist below which has been inspired by the ICO’s own ’12 steps to take now’ but tailored to the digital advertising industry to help towards compliance. We aim to update the checklist regularly so please do make sure to come back. We recommend that you use our members briefing alongside the list. You can also have a look at our Quick Q&A for a brief overview of the GDPR. 

Whatever stage of the compliance journey you’re in, we want to hear from you so please do email us at [email protected] for any questions you have on the GDPR and, of course, do check out the rest of our GDPR content on our GDPR Hub.

1. Awareness

2. Take stock and record your compliance journey

3. Legal basis for processing personal data 

4. Consent & Legitimate Interests

5. Pseudonymisation

6. Communicating privacy information

7. Individuals’ rights

8. Data controllers and data processors

9. Data breaches

10. Privacy by Design and Privacy Impact Assessments

11. Data Protection Officers

12. International

 

1. Awareness

The GDPR comes with hefty fines – up to 4% of global annual turnover. But this isn’t the only reason senior decision makers need to be aware of the new law. Some processes – and maybe even products – will have to change as a result of the GDPR. For many digital advertising businesses, this is the first time they will have to comply with a set of data protection rules as extensive as the GDPR. 

We recommend that you bring together different departments to raise awareness across all aspects of your business and draw up a compliance roadmap involving members of staff from all relevant departments. And don’t forget in your efforts that the GDPR will apply to all companies doing business in the EU, so make sure your colleagues overseas – particularly those based in the US – are involved and fully up to speed.

2. Take stock and record your compliance journey

Accountability is a central theme that runs throughout the GDPR. Key to being accountable is to document what personal data you hold and to identify any areas of risk. You can start with that now. Remember that the definition of personal data included in the GDPR covers more than personally identifiable information (PII). This is important to recognise as a number of data points that many in the industry currently consider to fall outside the scope of data protection legislation, will now be captured by the GDPR. That means that you shouldn’t assume that unique identifiers (e.g. cookie IDs or advertising IDs) are ‘anonymous’ data. 

As such, many IAB members may find it simplest to treat all online identifiers as personal data, so make sure you understand where the data comes from and get a clear picture of who you share it with. You should consider running an information audit to help with this exercise and any ongoing monitoring of your data practices. 

3. Legal basis for processing personal data 

Organisations require a justification to lawfully process personal data under the GDPR, including for collecting the data in the first place. The GDPR offers six legal bases: 

• Consent

• Contracts

• Legal compliance (with another law)

• Protecting the vital interests of a person

• Public interest

• Legitimate interest

The two legal bases most commonly used in digital advertising are consent and legitimate interest. As such, think of the various ways in which you process data and identify which legal basis best matches the types of processing you carry out. In some instances, you may find it useful to use a combination of consent and legitimate interest, depending on what kind of processing you intend to do or whether you want to process the data for another purpose.  

It is important to remember that under the current ePrivacy Directive (‘the cookie law) you have to use consent to access and/or store information on a user’s device. This means that from 25 May 2018, the stricter consent requirements introduced by the GDPR (see below) will apply in these circumstances. The European Union is currently reviewing the ePrivacy Directive which may lead to some changes to those requirements. 

4. Consent & Legitimate Interests

Consent plays a prominent role in the GDPR. However, consent is only one of six legal bases available to companies to process personal data as set out above and in some cases isn’t the most appropriate legal basis. The GDPR strengthens the conditions for consent compared to existing rules. In general, consent has to be freely given, specific, informed and unambiguous. Importantly, it now requires a positive action from the individual to be valid. If you intend to process sensitive personal data, consent will have to be explicit. 

Above all, the burden of proof is on companies to show that consent has been obtained lawfully, so being able to verify consent where relied upon as a legal basis or necessary (see above in reference to the 'cookie law') will be very important, particularly if another organisation obtains consent on your behalf. 

To help companies comply with the GDPR's consent requirements where they apply, IAB UK have contributed to IAB Europe guidance on consent and IAB Europe's Transparency & Consent Framework - an industry initiative to help companies comply with the GDPR's consent and transparency requirements. To find out more about the IAB Europe Transparency & Consent Framework, please visit www.advertisingconsent.eu

You will also want to have a look at the ICO's guidance on consent which is available here.

Companies can rely on 'legitimate interests' for the processing of personal data as long as the individual's interests aren't overriding. In practice, this means that companies need to conduct a balancing test to assess whose the balance of interests. The IAB has contributed to the Data Protection Network's Guidance on Legitimate Interests to help companies understand where they can apply legitimate interests through examples and a useful template assessment.

5. Pseudonymisation 

The GDPR introduces the concept of pseudonymisation for the first time into EU data protection law. We understand pseudonymisation to incorporate two related concepts. Pseudonymisation can be a process that data can go through – for example encryption, hashing or tokenisation – to ensure the data is no longer directly linked to an individual. Personal data that does not have any directly identifying details could also be pseudonymised at the point of collection. For example, a randomised cookie ID that allows a user to be recognised but not directly identified. 

In either case, companies must remember that whatever form of pseudonymisation you use, the data remains personal data under the GDPR. That said, there are obvious benefits to pseudonymisation as a privacy and security-enhancing measure, not least as companies that pseudonymise data are alleviated of some of the GDPR’s obligations (see more under point 7 – individual rights). Pseudonymisation can also help in the balancing test you have to go through if you want to rely on legitimate interest for any of your personal data processing (see point 3 above).

6. Communicating privacy information

Transparency is another core element of the GDPR. Privacy policies and notices have long been used in our industry to communicate to users how and why organisations use data. The GDPR requires different levels of detail depending on whether you obtain the data directly from the individual or not. In all cases, your notice will – amongst others – have to be concise, easily accessible and written in clear and plain language. It will also have to include the legal basis you use and explain your legitimate interest in processing personal data if that is the or one of the legal bases you operate under.

As such, have a look now at the privacy notices you currently use and analyse what needs changing and begin drafting those changes if you haven’t yet. It’s key that every organisation involved in collecting and using data disclose this information, starting with publishers all the way through each relevant third party. 

The ICO’s guidance on privacy notices, transparency and control is a great starting point. Also make sure to consult the section on ‘the right to be informed’ in the ICO’s GDPR overview.

7. Individuals’ rights 

The GDPR affords individuals extensive rights. These are: 

• The right to be informed (see point 6 above) 

• The right of access

• The right to rectification

• The right to erasure

• The right to restrict processing

• The right to data portability (see Article 29 Working Party guidance for more detail)

• The right to object (the right to opt-out)

• The right not to be subject to automated decision making, including profiling (see Article 29 Working Party guidance for more detail)

Check your processes to ensure that you can adequately respond to any requests you might receive from individuals. 

IAB Europe have produced useful guidance to help companies understand their obligations to respond to requests from individuals. We strongly recommend you consider the guidance which is available here.

8. Data controllers and data processors

The GDPR maintains the notions of ‘data controller’ and ‘data processor’ found in current data protection law to distinguish between the different roles organisations play in the processing of personal data. As a reminder, data controllers are organisations that decide – either alone or jointly with other controllers – who and why personal data is processed, whereas data processors act on behalf of the data controller. This means that only the controller is held liable for data protection compliance under current rules, not the processor. 

Importantly, the GDPR extends statutory obligations to data processors. This means that data processors may be subject to enforcement action from Data Protection Authorities and any potential fines (remember, up to 4% of global annual turnover) from May 2018. Under the GDPR, obligations for data processors include: 

• Data Agreements – processors must have a written contract (or other legal act) in place with controllers. This has to set out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller

• Data security – processors must take appropriate security measures and inform controllers without ‘undue delay’ in the event of a data breach (see below).

• Sub-processors – processors can only use sub-processors with the prior written authorisation of the controller. Vendors will also have to give the data controller the opportunity to object to any changes in the use of sub-processors.

• Controller instructions – processors may only process personal data in accordance with the instructions of the controller.

• Accountability – processors must maintain records of data processing activities and make these available to the relevant Data Protection Authority on request.

• Data Protection Officers – processors must, in certain circumstances, designate a data protection officer (see more below).

• Cross-border transfers – processors must comply with restrictions regarding cross-border transfers (see more below).

Given that both data controllers and processors will have obligations under the GDPR, it is important for companies to clarify their roles. Even during the process of a brand campaign, these roles can change. 

Whilst drafted for current rules, we recommend you consider the ICO guidance on the issue to help in that exercise, during which you may, for example, want to figure out your role in audience segmentation. Do you do it alone or only under instruction from, for example, brands or publishers? Does it differ from client to client? In any case, start working on contracts with your partners now and review those that are already in place to ensure they are in line with GDPR requirements. 

9. Data breaches

Personal data breaches can have far reaching consequences, both in reputational and financial terms. You should therefore make sure you put in places processes that allow you to detect, report and investigate a breach. Compared to existing rules, the GDPR requires data controllers that has suffered a breach where the individual is likely to suffer some form of damage, such as through identity theft or a confidentiality breach, to notify their Data Protection Authority – the ICO in the case of the UK. Data processors are required to notify the controller without undue delay of any breach they have incurred (see more about data controllers and data processors above). Start now to identify those types of data that may trigger the notification requirement. The information audit mentioned under point 2 may help you achieve that. Check Article 29 Working Party guidance on breach notifications for more detail.

10. Privacy by Design and Privacy Impact Assessments

Privacy Impact Assessments (PIAs) – or Data Protection Impact Assessments (DPIAs) as the GDPR calls them – play a significant role in the new rules. Long considered good practice, it is now a legal requirement to run a PIA in high-risk situations, for example where a new technology is being deployed or where a profiling operation is likely to significantly affect individuals. It is currently unclear whether this requirement will apply to processing pseudonymous data. 

The GDPR also codifies the principles of privacy by design and default into law. In both cases, carrying out a PIA can help you assess how to incorporate these two principles into any new products or services you want to bring to market. The ICO has produced guidance on Privacy Impact Assessments (PIAs) which, again, provides a great starting point for this exercise.

11. Data Protection Officers

The GDPR stipulates that one of the criteria to decide whether you need to designate a Data Protection Officer (DPO) is where ‘the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale’. 

If this applies to your company, then you will have to appoint someone with the responsibility for your GDPR compliance. You will also have to think where in the business structure and governance this person will fit in. To help with this, consult the Article 29 Working Party’s guidance on DPOs. 

12. International

Most businesses in our industry operate across Europe. Where this is the case you need to identify which Data Protection Authority will be your ‘lead authority’. This is particularly relevant in the case of Brexit as you may not be able to designate the ICO as your lead authority depending on the future role of the ICO within the European data protection framework. In those circumstances, UK-headquartered businesses are unlikely to benefit from the GDPR’s notion of a ‘one-stop-shop’ and would have to deal with multiple Data Protection Authorities across the continent. The Article 29 Working Party’s guidance on lead supervisory authority is useful to help with the exercise of determining your lead authority.  

Importantly, you should also think about your options for transferring data to countries outside the EU. You might have to do this for the first time as prior to the GDPR, you may have not processed personal data.

The GDPR offers a number of options to transfer data across borders. Transferring to countries that the European Commission considers to provide an ‘adequate’ data protection standard is seamless. The list of countries currently enjoying this status is available here and include the EU – U.S. Privacy Shield. Other options exist, including the use of standard contract clauses.  

It remains to be seen if the UK will also be considered ‘adequate’ in data protection terms post Brexit or if another solution will be found. The UK Government will also consider an agreement with its US counterparts to ensure the continued flow of data between the two countries as the UK won’t be able to benefit from the EU – U.S. Privacy Shield once the country has exited the EU.