The adtech industry’s unlawful data flows

The adtech industry’s unlawful data flows

research-01
litigation-01

Organisation Name

Open Rights Group (ORG), Civil Liberties Union for Europe (Liberties) and Panoptykon

Country/Jurisdiction

EU-wide

Thematic Area

Privacy and data protection

Current Status

Research complete; litigation ongoing

Description

The online advertising industry (adtech) is built on the trade of personal data, including intimate and sensitive details about individuals. Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used. This process is known as real time bidding. ORG, Liberties and Panoptykon are concerned adtech is insufficiently regulated and that real time bidding breaches European data protection and privacy laws.

In 2018, ORG filed complaints about real time bidding to the data protection authorities in Ireland and the UK. In 2019, with the support of a pre-litigation research grant, ORG hosted a workshop and developed a plan for further co-ordinated complaints to data protection authorities across the EU.

Building on the plan developed, ORG, Liberties and Panoptykon received a new grant in 2020 supporting their work together to take co-ordinated litigation, advocacy and campaigning activities. They aim to put pressure on data protection authorities across Europe to investigate and take enforcement action against the online advertising industry. So far complaints have been made to 21 data protection authorities across the EU.

Additionally, in late 2020, ORG took the UK Information Commissioner’s Office to court for failure to act on one of the initial complaints filed in 2018.

In August 2020, the Belgian data protection agency released an investigation report finding that the Interactive Advertising Bureau’s framework for getting user consent for online advertising violates the European General Data Protection Regulation. The findings still need to be validated by the data protection agency’s enforcement section, and will likely be contested. But this is still a major step towards getting a ruling that would force changes to the current online advertising business model.

"Information about individuals is shared and sold across thousands of online advertising companies without users’ informed consent or knowledge about who has access to their data or how it is used"

Strategic Goal

A ruling from a data protection authority that forces a transformation of how online advertising works in the EU so that it is human rights respecting, including by giving users effective control over how their data is used for advertising.

Organisation Name

Women’s Link Worldwide