On 12 September 2018, complaints were filed with the UK Information Commissioner’s Office and the Irish Data Protection Commissioner regarding the “wide scale and systemic breaches of the data protection regime” by Google and others in the online advertising industry (the Complaints).

The Complaints

The Complaints were submitted by Brave, an ad blocking web browser, together with the Open Rights Group and Michael Veale, a researcher at University College London. They focus on the real time bidding (RTB) systems used by Google and the wider online advertising industry, which operate to provide personalised advertising on websites.

It is claimed that there are ongoing breaches of applicable data protection laws across the industry. As an example, a wide range of personal data is gathered by the RTB system, far more than is necessary to provide targeted advertisements to individuals browsing the web. It is suggested that the information collected is then provided to a host of third parties for a range of uses that go far beyond those purposes which a data subject can understand, consent to, or object to. According to Brave, “every time a person loads a page on a website that uses programmatic advertising, personal data about them are broadcast to tens – or hundreds – of companies”.

Further claims are made regarding the industry’s lack of control over the personal data once it has been disseminated, due to the sheer number of recipients. It is suggested by Brave that it is not possible to protect against further, unauthorised processing of that data or to properly notify data subjects of the recipients of their personal data. As such, the personal data is not secure once broadcast.

It is also noted that the data collected may often include special categories of personal data due to the nature of the websites that individuals are browsing. The speed at which RTB occurs means that such special category data may be shared without any consent or control over the sharing of that data.

Requests of the supervisory authorities

The complainants have asked for an industry-wide investigation into the data protection practices by the behavioural advertising industry and that other EU data protection authorities are engaged in a joint investigation. The complainants have also invited the regulators to:

  • carry out an assessment of whether the industry is complying with relevant data protection legislation;
  • seek a consensual audit of the industry;
  • issue appropriate codes of practice or guidance; and
  • if necessary, take enforcement action.

Next steps

In a blog post announcing the Complaints, Brave suggests that this appears to be the first action of this nature since the application of the GDPR. Whether or not it leads to a fundamental change of the current online advertising model, the regulators will need to properly address the concerns set out in the Complaints. Further, the focus on whether ad tech firms and, specifically, Google operate in compliance with the GDPR remains at issue.