The GDPR contains a number of derogations (exemptions) by which the UK, as an EU Member State, can exercise discretion over how certain of the GDPR's provisions will apply.
The DCMS recently issued a Call for Views about these derogations, which set out 13 themes on which respondents were invited to comment. Although most of the themes are not significant for the ad industry, the derogation relevant to Article 22 of the GDPR certainly is. Article 22 deals with automated decision-making, including profiling, a key issue for those involved in online behavioural advertising. Article 22.1 says that a person has a right “not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”. Article 22.2 explains that this does not apply, though, if the decision is based on the data subject's explicit consent - pretty much impossible to obtain in the case of online behavioural advertising - or if authorised by Union or Member State law. It is this last caveat that is the derogation, allowing the government to authorise these types of decision.
The IPA responded by explaining that profiling is an essential tool used in the provision of targeted, relevant, online advertising - a sector in which the UK excels – and that we require the Government to authorise decisions based on profiling for the purposes of online advertising so that they will not fall within the scope of Article 22.1. That would mean that they would not require explicit consent in order to be lawful.
As an alternative, we also asked Government to confirm that decisions based on profiling for the purposes of online advertising may also be carried out for a legitimate interest – meaning that they would not require any consent, explicit or otherwise - and/or that they do not, in any event, produce legal effects or similarly significantly affect people and so, again, should fall outside of the scope of Article 22.1.
The aim, then, is to persuade Government to authorise decisions based on profiling for online advertising so that those decisions do not fall within Article 22.1 and so will not require explicit consent. Online advertising is a hugely successful sector within the advertising industry and one at which the UK excels. Article 22.1 could seriously hamper the right for agencies to deliver targeted online advertising for their clients.