Why changes to personal data usage could change direct marketing forever

Information Commissioner’s Office is investigating how firms share personal data and that could have far-reaching consequences for marketing

Targeted online marketing could become a lot more challenging as the Information Commissioner’s Office (ICO) investigates how firms share personal data.

With a remit to govern GDPR and protect the public’s personal data online, the ICO is looking at how personal information is shared between businesses so that online adverts are shown to a more targeted audience. It forms part of a reactivated adtech investigation into real time bidding (RTB).

The implications for retail industries are obvious, including automotive, which relies on the marketing method to efficiently target customers.

Speaking at the restart of the investigation, Simon McDougall, ICO Deputy Commissioner, said: “The complex system of RTB can use people’s sensitive personal data to serve adverts and requires people’s explicit consent, which is not happening right now.

“Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data.

“Our work will continue with a series of audits focusing on data management platforms and we will be issuing assessment notices to specific companies in the coming months. The outcome of these audits will give us a clearer picture of the state of the industry.”

The ICO has already acted against credit reference agency Experian’s offline direct marketing services, and ordered the firm to make fundamental change to how it handles people’s personal data.

McDougall warned: “All organisations operating in the adtech space should be assessing how they use personal data as a matter of urgency – particularly in respect of consent, legitimate interests, data protection by design and data protection impact assessments.”

While the tone of the ICO is one of negativity toward targeted online ads, experts are confident there won’t be an outright ban.

Maria Johnston, director and Head of Advertising and Media Law at automotive specialist Radius Law, said: “It’s all about that spooky thing where you’re Googling something and then you’re being shown related adverts for that thing. People understandably have an issue with that.

“The question is who is processing your data? There’s also a question about that data actually being personal. The advertiser or agency may not know the exact person, and to a point, advertisers don’t care who the person is as they don’t see them as a person, just a number.

“The trouble for the ICO is that everyone involved from the advertiser, the agency, the various platforms, as well as the publisher all have a hand in the process and all are keen to point the finger elsewhere. It means the ICO doesn’t know where to look as it’s very complicated, taking a fraction of the time it takes to blink any eye to conclude the entire process of calling for, bidding and serving an ad.

“There has been debate about whether each individual needs to consent to this data processing or whether the ad industry can rely on legitimate interests. The ICO has been clear that it needs consent. Legitimate interest has to be balanced against everyone’s interests, rights and freedoms.

“Advertisers contend they will struggle to provide effective marketing and achieve the ROIs demanded without profiling.

“The argument will be that without targeting, consumers will see more spam emails and ads. The advertising conundrum remains; is it better to see a narrower set of targeted ads, or a broad spectrum of ads with little or no consideration of the recipient.

“The safe option at the moment is to not advertise using these methods, but we understand that this will not be feasible for most advertisers. The ICO is still investigating real time bidding and adtech, and we think it’s unlikely it’ll act until that’s concluded. Any action is likely to veer away from enforcement initially. What’s more likely is that we’ll see more negotiation and a working solution reached.

“The ICO isn’t likely to go after the advertiser first either. As advertisers, the Direct Marketing Association’s seven step guide is a good place to start considering what, if any action, you can be taking to anticipate any changes that the ICO’s investigation may require.”

The ICO investigation is another development that businesses need to be aware of. It could add to the squeeze on advertising, especially as both Google and Apple are changing the information they share that helps businesses identify potential customers.