IAB responds to ICO’s real-time bidding concerns

The ICO’s report summarised its review of the use of personal data in the RTB process in terms of GDPR and ePrivacy legislation.

The ICO allowed a six month period for industry engagement and for it to respond to the report’s findings.

IAB UK has led this process and has subsequently committed to a series of actions on six key issues raised in the ‘Update report’, to help improve standards of compliance.

1. Data security: IAB UK will develop good practice guidance covering security, data minimisation and data retention, and work with IAB Europe to explore how the requirements in the Transparency and Consent Framework (TCF) policies could be enhanced to support such good practice.
2. Special category data: Develop UK-focused guidance on the content taxonomy, education for the industry on special category data restrictions and requirements and identify potential controls to minimise risks from the content of referred URLs in bid requests.
3. Reliance on legitimate interests for cookies: educate members on the consent requirements of UK ePrivacy regulations, with reference to the ICO’s current cookie guidance.
4. Legitimate interests assessments (LIAs): IAB UK will educate its members on LIA requirements, taking into account the outcomes of a joint review of anonymised example LIAs.
5. Data Protection Impact Assessment (DPIAs): encourage members to review their processing operations in light of the ICO’s existing guidance.
6. Transparency and fairness of information provided to consumers: IAB UK will engage with IAB Europe on the outcomes of ongoing discussions about potential changes to TCF policies with respect to consent management provider user interfaces, and then decide on any further action.

Simon McDougall, ICO’s executive director for technology and innovation, said: “Our ‘Update report’ documented our concerns with how personal data is processed using RTB, and our subsequent engagement work with the adtech industry has largely validated these concerns. We’re very pleased with the engagement we’ve had so far and, while we still have a long way to go, we’re optimistic that an industry-led solution is possible.”

Christie Dennehy-Neil, IAB UK’s head of policy and regulatory affairs, added: “It’s now critical that we work together with our members to implement change. This needs everyone – advertisers, intermediaries and media owners – to work with us, and to be willing to take action and invest in making changes where necessary.”