,
12 tweets,
7 min read
Read on Twitter
The ICO has released a report in partial response to the UK complaints of myself and @jimkillock on real-time bidding fixad.tech, along with many international complaints to other DPAs. Highlights threaded:
The ICO believe the use of legitimate interest in the real time bidding supply chain, even after cookie placing, is impossible. 
The ICO are clear that inferred special category data is exist category data, and requires explicit consent to process.
“The creation of these v detailed profiles, which are repeatedly augmented with info about actions that individuals take on the web, is disproportionate, intrusive and unfair in the context of the processing of personal data for the purposes of delivering targeted advertising”
Contractual controls to assure security amongst the 1000s or chained actors are not enough.
There are no guarantees or technical controls on data use downstream.
The ICO have seen no evidence that DPIAs are being carried out across this sector.
Truncation of bid requests or local privacy preserving targeting (a la @realhamed) have potential but there is no evidence the market is moving to adopt these voluntarily. Even if they did, they would not ‘sufficiently address our concerns’
Pretty damning conclusions from @iconews on the ‘systemic’ state of illegality in the industry.
See the other complainants including @johnnyryan @Jausl00s @PiDewitte @gemmagaldon @OpenRightsGroup @szymielewicz @diegofanjul_ @bitsoffreedom @LibertiesEU, kickass lawyer @RaviNa1k and on a very related complaint on data brokers, the brilliant @privacyint
However, we need action. The next steps in this report need to be much more firm. AdTech is illegal in its current form: letting it continue undermines the GDPR in all sectors.
see press release from @OpenRightsGroup here
