UK privacy regulator calls on brands to stop ‘bankrolling’ illegal activities
It’s been more than a year since the General Data Protection Regulation (GDPR) ushered in the biggest shake-up to privacy regulations in the last two decades, yet brands continue to fund businesses that are misusing people’s personal data.
That’s the view of the UK’s privacy regulator, which is cracking down on illegal data use and is asking brands to think seriously about the role they play in funding a murky, unethical and non-transparent digital ecosystem.
Speaking to Marketing Week, Simon McDougall, executive director for technology and innovation at the Information Commissioner’s Office (ICO), says brands should be aware that the ICO has “big concerns” and will be “accelerating” its enforcement of data compliance.
“They should be aware that we are moving in this space and trying to move the industry,” he says. “They should be aware that if the industry doesn’t move then, from our point of view, the advertisers will be bankrolling illegal activities.”
Over the last few months, the ICO has been reviewing how personal data is used in real-time bidding (RTB) in programmatic advertising. Having spoken to advertisers, publishers, and ad tech vendors and intermediaries, it says it is “surprised” at how little consistency there is between different parts of the media landscape.
We need to change the way this market works and how it works operationally, rather than end up playing regulatory whack-a-mole.
Simon McDougall, ICO
It is especially concerned that sensitive data – data that relates directly to health, sexuality or religion – is being shared and used without people’s consent at scale.
As an example, a recent Privacy International study found that popular websites about depression in the UK, France and Germany have been sharing user data with advertisers, data brokers and large tech companies.
GDPR requires brands to have explicit consent for sensitive data, which is a higher bar than for other data. Yet 97.8% of all web pages analysed contained a third-party element – including Google, Facebook and Amazon trackers on a number of web pages.
Privacy International also found two depression test websites, including the NHS mood test, have been using a third-party service to log and playback everything users type or click on the website, which NHS Digital has since denied.
“We have been clear in our report that there are really serious issues with current practices,” McDougall says.
“We are looking to change the ecosystem. If we don’t make progress, the question I have for brands and advertisers is: ‘If we, as a regulator, conclude this industry can’t reform itself, and people’s information is being used irresponsibly and illegally, at what point does it become unethical for brands to be bankrolling these practices?’.”
Would you take privacy advice from Facebook?
The ICO, which is an executive non-departmental public body sponsored by the Department for Digital, Culture, Media & Sport, is trying to find a way to stop the processing of sensitive data in an open RTB system. Or a way to start asking for explicit consent.
But it will not be taking any regulatory action for the next six months while it engages with the industry. McDougall says the ICO knows how vital advertising and RTB is to the ecosystem – publishers need revenue, advertisers need audiences, and adtech vendors need data to stay competitive – which is why it doesn’t want to rush into markets and “break them”.
“The way this market has evolved, step by step, it is now very large and complicated,” he says. “Simply going in and trying to enforce against a small number of individual controllers – the firms that are taking decisions about the data – isn’t going to move the needle here because there are thousands of firms involved and they are being driven by market forces.
“We need to change the way this market works and how it works operationally, rather than end up playing regulatory whack-a-mole.”
In the meantime, the ICO wants brands to engage with their trade associations, ask their agencies what they’re doing, and ultimately ask the people they’re paying “if they are part of the problem or the solution”.
“Until there’s challenge coming from the brands, then there’s no pressure on the agencies,” he says. “As with many other areas of business, the ethical questions take time to evolve. The commercial pressures come alongside the ethical pressures.”
The post UK privacy regulator calls on brands to stop ‘bankrolling’ illegal activities appeared first on Marketing Week.