ICO publishes data protection & privacy expectations
Posted on: Thursday 25 November 2021 | IAB UK
The Information Commissioner’s Office (ICO) has laid out data protection standards that it expects companies to meet when developing new ad tech solutions
In a Commissioner’s Opinion published today, the ICO recognises that since its 2019 ‘Update report into ad tech & real-time bidding’, the “industry has developed a number of initiatives that seek to address the risks ad tech poses and shift towards less intrusive tracking and profiling practices”.
The update lays out key privacy principles and recommendations that the ICO expects any solution, proposal or initiative to meet in the future. These span user choice, accountability, data protection by design and meaningful user control. You can find the full list on pages 43-46 here.
Outlining the remit of the Opinion - and in the context of key developments in the ad tech space such as Google’s Privacy Sandbox that is working to develop a replacement for third-party cookies - the Information Commissioner Elizabeth Denham explains: “This Opinion addresses developments since the 2019 report, including those from Google and alternatives from other sources. In general, the Commissioner’s view is that these developments are not yet sufficiently mature to assess in detail… Until they reach an appropriate level of development, the Commissioner will reserve detailed analysis and responses to specific proposals and detailed consideration of the broader impacts they may have.
“Instead, this Opinion outlines the Commissioner’s overarching expectations that any development seeking to address the risks posed by ad tech should meet. These include expecting market participants to address the issues highlighted in the 2019 report.”
The privacy standards state that new advertising technologies should offer people the ability to receive ads without tracking, profiling or targeting based on excessive collection of personal information.
If people choose to share their data, the ICO states that all companies within the ad tech supply chain must ensure there is meaningful accountability and that people have control over their data. Denham adds: “My office will not accept proposals based on underlying ad tech concepts that replicate or seek to maintain the status quo.”
Since the ICO issued its 2019 report, we at the IAB have been working closely with our members to develop guidance to address real-time bidding concerns raised by the ICO and help businesses comply with their responsibilities under UK GDPR and ePrivacy legislation. The guides cover cookies and consent, special category data, data protection impact assessments and legitimate interests assessments. Find them all here.
We welcome the clarity that the ICO’s latest Opinion provides and will continue to work with our members to communicate the core principles we laid out in January 2020 regarding viable User ID solutions. These include that “a sustainable, ad funded internet is one that is transparent on what data is being collected, how it is being used, and by whom”, as well as “giving the user control of their data and prioritising privacy”.
Online Advertising Programme could be a huge opportunity – if we engage with change
Our Head of Policy and Regulations, Christie Dennehy-Neil explains the scope and implications of the Online Advertising Programme. This piece was first...Learn more
Digital ad spend is thriving – but we can’t afford to be complacent
Our industry is at a crucial moment and what we do next will significantly define the future of the online ecosystem, writes our CEO Jon Mew. This piece...Learn more
IAB Tech Lab launches PETs Working Group to support sustainable privacy solutions
The Privacy Enhancing Technologies (PETs) Working Group to support the creation of long-term sustainable solutions to privacyLearn more