Despite progress, the online advertising industry and UK regulators are still at odds over the “legitimate interest” definition under the GDPR.

Following publication of the UK Information Commissioner’s Office’s (ICO’s) report on adtech and real time bidding in June 2019, the ICO has been working closely with the online advertising industry to improve data protection practices by the end of the year.

Simon McDougall, the ICO’s Executive Director for Technology Policy and Innovation, reportedly stated at the recent AdTech London event that the ICO has made progress with the industry, including through workshops with Google and the Interactive Advertising Bureau Europe (IAB), which were both featured in the June report. However, McDougall noted that there is still “a very big difference” in how the online advertising industry and the ICO view the “legitimate interest” legal basis for processing personal data under the General Data Protection Regulation (GDPR). The ICO has yet to be convinced of the use cases in which the industry is seeking to rely on the legitimate interest basis.

McDougall confirmed the ICO’s preference for changes to come from industry, rather than regulatory action. He assured the audience that he anticipates no sudden crackdown on minor non-compliance in December 2019, when the ICO may conduct a further industry review. Nevertheless, organisations processing personal data using adtech and real time bidding should make efforts to bring their practices into line with the ICO’s recommendations, and should expect increased regulatory attention from data protection regulators across Europe.

The ICO published its report on adtech and real time bidding in June 2019, which noted widespread compliance concerns throughout the adtech industry. See Adtech and Real Time Bidding in the Regulatory Crosshairs for more information.