AdTech RTB and the IPA’s call with the ICO

Following the ICO’s second AdTech Forum last month, the IPA arranged a conference call for some IPA member-agencies with the Information Commissioner’s Office (ICO) on Monday, 9 December. The purpose of the call was to help the ICO understand the RTB ecosystem and the role of agencies within it as part of the ICO’s continuing investigations into how personal data is used in Real Time Bidding (RTB).

The ICO accepts that the AdTech industry is complex and that change is difficult to achieve, but it does expect commitment from the industry to improve. For now, its key concerns are around data security, special category data and the lawful basis relied on by those in the industry to process personal data in RTB. The ICO expects to publish information on ‘next steps’ on 20 December.

The ICO wants the IPA and other relevant trade associations to provide guidance for their members in order to help drive best practice. Those associations should try to ensure that their respective pieces of guidance are consistent and do not conflict. On this point, the IPA is working with members on a set of RTB Best Practice Principles and is involved in the Advertising Association’s Digital Advertising working group.

Some key issues discussed with the ICO include:

• Data security – due diligence must be used in addition to agreeing contracts. An industry-standard due diligence questionnaire could help businesses ask the right questions of suppliers, perhaps via the Advertising Association. (Meanwhile, agencies should continue to carry out thorough due diligence on their suppliers.)
• Special Category Data – must not be used without explicit consent. That includes inferred special category data derived from urls included in bid requests. Agencies should read the ICO’s general guidance on Special Category Data, in particular the paragraph headed: “What about inferences and educated guesses?” under the first section: “What is special category data?”.
• Lawful basis – the reliance on legitimate interests (LI) rather than consent to process data, and the inadequate use of legitimate interest assessments (LIAs). The ICO has seen no compelling arguments as to why LI may be relied on for processing RTB personal data and the LIAs it has reviewed have been wholly inadequate.

The IPA will continue working with members on our RTB Best Practice Principles and with the Advertising Association and other trade associations to try and ensure a level of consistency around industry guidance. We will also continue the dialogue with the ICO.

We have also produced a summary of the call with the ICO.

Please get in touch with Richard Lindsay, Director of Legal & Public Affairs, if you need more information.