ICO halts investigation into adtech industry - DMA responds

For the past two years, the Information Commissioner’s Office (ICO) has been investigating a complaint into the programmatic advertising industry, submitted by Brave, the Open Rights Group and the University College London.

The complaint expressed concerns about how Google, IAB Europe and other companies in the online advertising industry were processing and sharing consumer data – accusing them of a number of privacy violations under the General Data Protection Regulation (GDPR).

However, it now appears that members of the online advertising industry will not face any further action or investigation from the regulator. The ICO said in August that it was not appropriate to single out specific companies as the data protection concerns expressed were systemic and industry-wide issues.

The letter sent to the complainants by the ICO stated: "Taking action against a small number of actors within a large and complex industry would not necessarily achieve the desired outcome of influencing change across the sector."

In response, Jim Killock, executive director of Open Right Group, and Michael Veale, a professor at University College London, have filed a legal challenge to how the UK’s data protection authority handled the investigation.

This decision by the ICO has much wider implications, as other key areas of the data and marketing industry have been aggressively pursued by the ICO in recent weeks.

In October, the ICO ordered the credit reference agency, Experian Limited, to make fundamental changes to how it handles people’s personal data within its direct marketing services by issuing an enforcement notice. This followed a two-year investigation into how credit rating agencies (CRAs) processed and shared data within their data broking businesses for direct marketing purposes.

The DMA is calling on the ICO to be more consistent with its enforcement policies and public announcements, as clearly two very different approaches have been implemented.

“The ICO has closed one of the most publicised complaints against the programmatic advertising industry since the GDPR came into force. It has done so with seemingly no outcomes or even a public statement. This just weeks after making very public announcements about their enforcement notice to Experian, as well as issuing record-breaking fines for British Airways and Marriott International for data protection violations,” said John Mitchison, Director of Policy & Compliance at the DMA.

“There are clear discrepancies between how the ICO investigates and administers enforcement to different parts of the data and marketing sector. Their recent actions against a handful of credit rating agencies contradicts their statement that it would be ineffective to act against a small number of companies when it is an industry-wide issue. If the ICO would like to work with industry sectors to make meaningful change, as opposed to taking disciplinary action, then it must be more consistent with its policies and how investigation outcomes are communicated to the general public.”