The ICO must fix the Adtech industry

When we first took on the ad industry we knew it would not be simple. The ad industry is making a great deal of money, often at the expense of publishers as well as our privacy. But we did expect the Regulator to play their role in fixing the problem.

The initial steps were promising. The ICO investigated the issues in our complaint and wrote a highly critical report, finding the industry to not be complying with the GDPR. That was no surprise to us, as our complaint outlined how the AdTech industry could not comply with the basic premises of the data protection regime. 

The ICO also held two industry-wide meetings, where the industry could not provide answers to our complaints. Google and the Internet Advertising Bureau introduced changes to their systems, with the IAB amending their “trust and consent framework” and Google making some changes to the manner in which personal data is disseminated across the AdTech ecosystem. 

However, while those changes were welcomed by the ICO as progress, the truth is the changes were very cosmetic and did not cure the problems and data protection concerns that we had raised. There was nothing that looks like substantive meaningful change in practice.

The net result is that we have been bitterly disappointed. Two years after Michael Veale and I filed a formal complaint to the ICO, the actual results to improve the industry are very poor.

The “pause” to investigations during the COVID-19 period was also highly disappointing. There was no reason to shut down this process, even temporarily. The abuse continues at huge scale and needs resolving. Other data protection authorities in Europe are continuing with their processes, and are beginning to get results.

When we asked questions about the pause in the investigation and when the ICO will start taking steps to address the conduct that the ICO had found to be unlawful, the ICO did not engage with. Instead, the ICO took the decision to shut down our Complaint entirely rather than answer our questions and keep us updated.

This is an extraordinary action. If the ICO is entitled to shut down a complaint, without progressing those complaints at all and not providing any update for a number of months then what is the point of the Complaint process? How can the ICO be said to acting to protect data subjects when there is no resolution about conduct the regulator has identified as breaching basic rights?

The ICO’s position is not just startling for our Complaint, but also speaks to a broken regulatory system. If the ICO’s position is correct, the ICO could decide not to act on any complaint. It would have complete discretion to find widespread abuse but ignore it, as it has done with our Complaint.

Our point is simply that we as data subjects are entitled to a remedy. Regulators, when they find systemic abuse, need to regulate. Which brings us to the other, age old question: who watches the watchers? Who is the regulator accountable to?

The GDPR provides for a data subject to have an “effective remedy” against a decision of a Supervisory Authority, namely, the ICO. That “effective remedy” takes the form of a statutory appeal under s.166 of the Data Protection Act. Unfortunately, that statutory appeal route has been interpreted narrowly by the Tribunal to date.

We therefore want to both have the decision to close our Complaint scrutinised and to ensure that the rights of data subjects against the ICO are upheld in full. It is not enough to complain about the law and the inaction by the regulator. We are here to change those laws and conduct.

That is why then we are going to the Information Tribunal. We must seek a remedy and accountability for the ICO through the mechanism that was envisaged under GDPR to do this. It is extremely important that this mechanism is made to work. The ICO must be accountable, complaints must be resolved, and, ultimately, the AdTech industry must be made to operate within the law.