The Information Commissioner’s Office (ICO) has released a preliminary report into how personal data is used in real time bidding (RTB) in programmatic advertising, saying it has concerns over how personal data is used in the process.
Published today, the ICO Update report into adtech and real time bidding which summarises the findings of a months long inquiry into RTB practices.
“We have focused on RTB due to its complexity, the risks it poses and the low level of data protection maturity we’ve found through some of our initial engagement. Whilst we accept that RTB is an innovative means of advertisement delivery, our view is that, in its current form, it presents a number of challenges to good data protection practices,” writes Simon McDougall, Executive Director for Technology and Innovation at the ICO.
The report focuses on the processing of special category data and issues caused by relying solely on contracts for data sharing across the supply chain.
“Under data protection law, using people’s sensitive personal data to serve adverts requires their explicit consent, which is not happening right now. Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data.”
The office said it will spend the next six months engaging with the adtech sector but wants to make sure changes occur.
“If you operate in the adtech space, it’s time to look at what you’re doing now, and to assess how you use personal data. We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, data protection by design and data protection impact assessments (DPIAs),” McDougall wrote.