As the nights draw ever-closer and the memory of temperatures topping 38° degrees become a fantasy sought whilst huddled around the radiator, ExchangeWire takes a look back at a busy late summer for the ICO.

Executives from the UK’s data protection authority took to the floor at several industry events to explain the rationale behind June’s Update Report into Ad Tech and RTB, as well as providing clarification on their “further industry review” which will take place in early 2020.

Fostering respect

Speaking on stage at this year’s ATS London, Ali Shah, head of technology policy at the ICO, stated that the objective of the report was to help shape an environment which fosters respect between businesses and consumers. Moreover, it was made clear that, up to this point, the ad tech industry was not doing enough to nurture this respect with consumers.

Simon McDougall, executive director for technology policy and innovation, appearing at the From Zero to Rezonence event, provided further exposition on what constitutes consent. Put simply, consent needs to be obtained for every user in every audience segment if that person remains identifiable, however aggregate data no longer assigned to an individual is fine. It is important to note that, in the ICO’s view, encryption does not necessarily solve this, as the data can still be linked to an individual, thus remaining ‘personal’.

Furthermore, the industry must ensure that consumer signals, such as an opt-out after previously opting in, should be able to be passed along the entire ecosystem freely. McDougall identified such signals will be closely analysed over the coming months.

Opportunity to show good faith

The six-month window stipulated in the report is an “opportunity for the industry to show good faith,” said Shah, and he gave an invitation to the ad tech industry to engage with them on their recommendations. However, this open-armed approach does not necessarily apply to contact with the ICO, as McDougall subsequently stated that the ICO would only be in direct conversation with the IAB, Google, and select trade groups at this stage.

While the opportunity for direct engagement may have passed, concerns and queries can still be directed to the IAB. Acting upon the report's stipulations, and implementing initiatives set out by the IAB, is now required to ensure that firms are handling data appropriately, and in accordance with a unified set of guidelines.

Opt-in vs Opt-out

Opting in and opting out should have “similar prominence” according to the ICO, and as we lolloped into October this has been ruled upon by the highest court in Europe, the Court of Justice of the Europen Union (CJEU). It was legally determined that pre-ticked boxes, or notices that simply come with an ‘OK’ option without giving equal prominence to a ‘deny’ option, would not constitute valid consent.

Moreover, according to the ruling, consent bundled with other purposes, such as playing promotional games or watching YouTube videos, would not be deemed as valid.

This will likely lead to headache among certain CMPs and site owners, such as the CJEU itself:

https://curia.europa.eu/jcms/jcms/j_6/en/, visited 15:21 07/10/2019

Sibling tactics will not wash

The ICO has also addressed the notion that any attack on the processes underpinning RTB will affect independent providers over the major platforms. Many in the industry have donned their poutiest faces, honed their finger-pointing skills and exclaimed, “What about GAFA?!”, in scenes reminiscent of distracting one’s mother during a bollocking about the fact you clumsily spilled some juice on the carpet, by revealing that your older brother had accidentally put a football through the shed window two days earlier, a sin which had gone unnoticed. However the ICO consistently stated on the summer events circuit that they are not the body responsible for ruling against the big tech behemoths, although they are assisting the Competition & Markets Authority (CMA) in their investigations.

Tide coming to wash away the heads in the sand

“The tide is coming in." Perhaps the most memorable line delivered by Shah at ATS. But what does this maritime forecast mean in practice? Put simply, bad actors need to sort their act out, swiftly. Those that are not absolutely sure of where they sit on the good/bad axis in the ICO’s morality nexus should reach out to them, or industry bodies such as the IAB, for guidance. The excuse of ignorance is no longer valid.

The six-month window is indicative of the fact that the ICO is offering an element of flexibility to make the requisite first steps in restoring trust between ad tech and the consumer, for now. However, if the industry is not deemed to be “evolving” then their action on breaches will be “proportionate”. To determine what constitutes proportionate, the body will compare the use of data within the RTB ecosystem to other use cases and breaches, which, given the inordinate scale of the programmatic ecosystem, suggests that the punishment for not engaging and developing solutions would be severe...

... and so it should be. The (very) few remaining head-in-sand, shoulder-shrugging, blasé bullcrappers are dragging the reputation of the entire industry through the mud. Let’s leave them behind.