British privacy campaigners said Thursday they had filed a legal challenge to how the country’s data protection watchdog handled an investigation into how Google and others handle people’s personal information in the online advertising industry.
Jim Killock, executive director of Open Right Group, and Michael Veale, a professor at University College London, submitted the appeal after the United Kingdom’s Information Commissioner’s Office told them the agency had concluded its investigation into their complaint, although would be pursuing its own independent probe into how companies collected people’s data to serve them ads across the worldwide web.
That separate investigation was put on hold in May because of the COVID-19 pandemic. The British privacy campaigners said they were concerned that Google and other companies in the online advertising industry would not be held to account for potential privacy violations under Europe’s strict data protection standards, known as the General Data Protection Regulation, or GDPR.
“It’s pretty clear that under GDPR, everyone is entitled to remedies,” Killock told POLITICO. “If they can simply dismiss our complaint without doing anything, they will never have to taken action.”
In response, the U.K.’s privacy watchdog said that it was continuing with its investigation into the so-called adtech industry, though would not comment on when it would reopen that probe.
The legal challenge, filed on October 21, comes as pressure mounts on how digital companies collect, store and use people’s digital information in the name of online advertising. The legal challenge to the U.K.’s privacy agency is likely to be resolved sometime next year, and could force the agency to reopen the now-closed complaint.
Last month, the Belgium data protection agency also reached preliminary conclusions that stated online advertising in Europe, in its current format, likely broke the 27-country bloc’s tough data protection standards. IAB Europe, an industry body that oversees these so-called ad auctions, or sophisticated online bidding marketplaces that allow advertisers to place their messages on websites, said that it disagreed. A conclusion in that separate case is expected early next year.
In the U.K., the country’s privacy regulator initially took a similar approach to how Google and others handled personal information to serve up ads. The concerns focus on people not having enough say over what data is collected, and who has access to it once it enters the complex online advertising world.
Last year, the British agency gave companies six months to clean up their act before possible regulatory action would be taken. In late 2019, the Information Commissioner’s Office said that, after consultation with industry players, it would urge tweaks to how firms handled people’s information, but held back on issuing specific fines or calling for remedies. It is unclear when the watchdog will restart its adtech inquiry.
Yet in a letter, reviewed by POLITICO, to both Killock and Veale that confirmed the conclusion of their complaints, the regulator said in August that while the campaigners had raised concerns specifically about Google and IAB Europe’s handling over their data, the possible data protection issues around the sector were systemic, and that it was not appropriate to single out specific companies.
“Taking action against a small number of actors within a large and complex industry would not necessarily achieve the desired outcome of influencing change across the sector,” the letter stated.
Want more analysis from POLITICO? POLITICO Pro is our premium intelligence service for professionals. From financial services to trade, technology, cybersecurity and more, Pro delivers real time intelligence, deep insight and breaking scoops you need to keep one step ahead. Email [email protected] to request a complimentary trial.