The Information Commissioner’s Office, the U.K.’s data protection authority, continued its tough talk tour on Wednesday, warning again that ad tech companies are coming up short in their compliance with the General Data Protection Regulation. The question now is when the ICO will back up its words with actions.
The latest verbal salvo came on Wednesday at an Interactive Advertising Bureau event in London. The ICO’s head of technology and policy, Ali Shah, vowed the regulator will use its “full power” this year to stop ad tech vendors from playing fast and loose with GDPR compliance. In June the authority gave companies six months to comply with the regulation. In the ICO’s estimation, which it has repeatedly stated in the past several months, many companies are coming up short in complying.
“Every time we look further into the [real-time bidding] space it reinforces the concerns we had at the beginning of the processes,” Shah said. “Those players in RTB who have ignored the window of opportunity to conform to regulation must prepare for the ICO to use its wider powers.”
Shah’s tone on Wednesday represents a subtle shift by the regulator, which has tried to exert maximum pressure on ad tech vendors without resorting to imposing fines or conducting full-blown investigations of specific companies. This prior, carrot-like approach functioned almost like a stick because members of the ad tech vendor community knew that the grace period would eventually end and noncompliant companies would be at risk of being discovered, Shah said.
But not all players in the advertising industry believe the regulator has done enough to enforce GDPR on businesses, (although they are still reeling from the fallout of the regulation going into effect).
“The ICO doesn’t have a culture of enforcement and doesn’t want to be seen as a bully,” said a data privacy expert who wished to remain unnamed. “They’ve acted like the friendly industry regulator and threatened fines if things don’t change, but it’s clear that some companies have called their bluff in the belief nothing will happen.”
This data privacy expert was irked by the ICO’s decision earlier this month to accept the IAB and Google’s recent proposals to reform how ads are traded in real time. The ICO backed the IAB’s plan to guide the ad industry on the collection of special category data, which has sensitive information about online users. In addition, the ICO accepted Google’s decision to stop sharing data about the type of content people consume online and improve its auditing process. The ICO arrived at that decision even though it confirmed in November that ad tech vendors had been processing special category data without users’ consent and were breaching the GDPR.
The ICO’s decision to seek improvements from Google and the IAB rather than punish both organizations is emblematic of a lack of enforcement of the GDPR across the board, said Darren Guarnaccia, chief product officer at digital experience platform company Crownpeak.
“The ICO is understaffed, and even when there is a clear violation like a breach, the lack of resources means it is common to give companies extra time to ‘fix’ their violations instead of handing out fines,” Guarnaccia said. “All of this is contributing to the general wait-and-see stance that some companies may be taking regarding GDPR.”
On Wednesday Shah, however, warned the ad tech industry to not regard its recent decisions as a sign the agency would let companies off the hook for data breaches. He did admit, however, ICO responses will take a while to materialize, given the opaque, intermingled makeup of the ad tech ecosystem. Under the GDPR, the ICO has the power to fine companies that breach the law as much as €20 million ($22.2 million) or 4% of their global revenue, whichever is higher. The ICO has already fined British Airways and Marriott International £183 million ($202.8 million) and £99 million ($109.8 million), respectively, for GDPR data breaches. But those fines stemmed from cyberattacks that pose a threat to personal data. They are not cases of a business potentially using data without users’ consent to target a banner ad. Fining ad tech companies isn’t as straightforward for the ICO it seems.
“If anyone feels like we’re stepping away from the issue or not acting quick enough, it’s important to remember that it takes significant steps to do the right due diligence about what appropriate action is needed,” Shah said. “The window to sit back and see what happens has closed.”
Member ExclusiveDigiday+ Research: Instagram wins over Facebook for role in brands’ holiday marketing
Brands differ on how they use each marketing channel during the holidays -- even when it comes to sibling social media platforms Facebook and Instagram, Digiday+ Research found.
How — and why — Candy Crush is in the midst of a 10th anniversary brand refresh
In the years since Activision Blizzard acquired the Swedish game studio King in 2016, employees at the gaming giant have started to internally refer to their company as “ABK” — that is, Activision Blizzard King. But the corporation’s recent financial reports indicate that “KAB” might be a more accurate abbreviation.
Independent agency Goat invests in influencer strategy for clients as it expands in the U.S.
Everyone is after influencers to up their marketing game. But the secret to success, Goat contends, is in viewing influencers as performance media and using data to deliver clients guaranteed outcomes.
SponsoredHow brands are measuring incremental performance on CTV
Connected TV is unique among other advertising channels because it combines linear television’s storytelling capabilities with digital marketing’s targeting and measurement. As more marketers leverage CTV advertisements to reach relevant and engaged audiences, they also want to understand the real value they are generating with their investment. Incrementality reporting and measurement allow advertisers to measure […]
Marketers bring Web3 to the FIFA World Cup with augmented reality, NFTs and virtual worlds
The month-long tournament, which begins this weekend, will be the first World Cup since it took place in Russia in 2018 long before “Web3” entered the global lexicon. Now, official and non-official sponsors are hoping to harness the hype with a range of NFTs, virtual worlds, augmented reality tools and other trendy tech.
U-Haul diversifies its social strategy to tell people it’s more than moving trucks
In recent years, U-Haul's in-house agency has been working to "better leverage social media for brand loyalty."