UK: Regulator says Adtech industry ignores data protection laws

The multibillion-dollar real-time bidding (RTB) adtech industry is processing data unlawfully, the UK’s data protection regulator has ruled, reported the Financial Times.

The Information Commissioner’s Office has found that personal data is being processed without consent, and people don’t have the security guarantees that they should under the General Data Protection Regulation (GDPR).

“Under data protection law, using people’s sensitive personal data to serve adverts requires their explicit consent, which is not happening right now,” says Simon McDougall, the ICO’s executive director for technology and innovation.

“Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data.”

The report found that companies were collecting and trading information such as race, sexuality, health status or political affiliation – which, as special category data, requires the specific consent of the individual.