The Information Commissioner’s Office (ICO) is the UK’s regulator responsible for data protection.
When you visit a website, some of the ads you see have been specifically selected for you. As the site was loading, the website publisher auctioned a space on the page you are viewing, and an advertiser bought it because it specifically wants to reach people like you. The process can involve many companies, and happens in milliseconds. Billions of online ads are placed on webpages and apps in this way every day.
The process – known as real time bidding – relies on the potential advertiser seeing information about you. That information can be as basic as the device you’re using to view the webpage, or where in the country you are. But it can have a more detailed picture, including the websites you’ve visited, what your perceived interests are, even what health condition you’ve been searching for information about.
Real-Time Bidding (RTB) is a set of technologies and practices used in programmatic advertising. It has evolved and grown rapidly in recent years and is underpinned by advertising technology (adtech), allowing advertisers to compete for available digital advertising space in milliseconds, placing billions of online adverts on webpages and apps in the UK every day by automated means.
According to the ICO report, While many RTB market participants place some controls on their processing and sharing of personal data, it’s become apparent that there are substantially different levels of engagement and understanding of how data protection law applies, and the issues that arise.
The report described number of concerns with the data protection practices within RTB, for instance:
- identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and methods of obtaining consent are often insufficient in respect of data protection law requirements
- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data
- the scale of the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place
It seems that more work needs to be done, in order to make sure our personal data is protected as expected.