27 Jan Transparency-related challenges of advertising technologies

Want to learn more about adtech? Watch Paolo Balboni’s Advertising technology: legal compliance requirements to fully exploit adtech in your marketing strategies webinar here.

As we explored in our last article, advertising technologies, also known as adtech, present a number of legal compliance challenges for businesses that aim to make use of the latest marketing trends specifically related to privacy and data protection. The main two laws to consider in this area are the General Data Protection Regulation and the ePrivacy Directive (as well as the forthcoming ePrivacy Regulation).

In 2019, both the French and the United Kingdom’s Data Protection Authorities, in fact, have shown increased attention specifically to Programmatic Advertising and the legal obligations of organizations with respect to transparency, the lawfulness of processing activities as outlined in the General Data Protection Regulation, the principle of data minimisation and the principle of privacy by design.

Programmatic Advertising is the automated purchase and sale of online advertising space conducted by way of computer platforms. The transaction occurs thanks to the analysis of personal data of the targeted individual which determines the placement of the ad.

The lack of transparency in programmatic advertising presents a significant challenge in the adtech landscape which by its very nature is vast both in terms of the amount of data (not compliant with the principle of data minimisation requires data processing to be sufficient to fulfil a specific purpose, relevant to that purpose, and limited to what is necessary) and number of actors involved, which at times may not even be known to the entity which initially collects user data.

Transparency is a fundamental principle outlined in the GDPR and is closely related to the principles of accountability and fairness in relation to the processing of personal data expressed in Article 8 of the Charter of Fundamental Rights of the European Union. Recital 39 of the GDPR provides us with further guidance with respect to the meaning of the principle of transparency, which “requires that any information and communication relating to the processing of those personal data [shall] be easily accessible and easy to understand, and that clear and plain language [is] used.” Article 12 GDPR and the Article 29 Working Party Guidelines on transparency call for information to data subject to be concise, transparent, intelligible and easily accessible and provided using clear and plain language.

However, given the great number of actors involved, and the fact that the organization collecting consent from the data subject is not able to adequately inform on the identities of such actors and the transfers that take place, the recipients of the data, and the categories to which such data belong, in violation of Articles 13 (information to be provided where personal data are collected from the data subject) and 14  (information to be provided where personal data have not been obtained from the data subject) of the GDPR, a lack of transparency seems nearly inherent to the technology itself.

The Interactive Advertising Bureau (“IAB”) in late August 2019 updated its GDPR Transparency and Consent Framework (TCF), aiming to help industry members comply with both the GDPR and the ePrivacy Directive and increase compliance with the principle of transparency.  The TCF provides technical specifications for actors in order to help them identify an adequate legal basis, further transparent communication to data subjects, and importantly, allow individuals to object to data processing. While this represents a step in the right direction and brings adtech closer to compliance with relevant legislation, more needs to be done.  While the complicating factors are clear, as the ICO recently underlined in a recent blog post, organizations active in the programmatic field should start by reviewing systems, documentation and processes, continue to engage with trade associations, and importantly, embed privacy by design into the use of such technologies.

To receive a copy of the ICTLC Guidelines on how to improve compliance in the adtech environment, write to Paolo Balboni – ICT Legal Consulting Founding Partner.