ICO News

UK Information Commissioner issues preliminary enforcement notice against Snap

• Snap issued with preliminary enforcement notice over potential failure to properly assess the privacy risks posed by its generative AI chatbot 'My AI'

• Investigation provisionally finds Snap failed to adequately identify and assess the risks to several million 'My AI' users in the UK including children aged 13 to 17.

The Information Commissioner's Office (ICO) has issued Snap Inc with a preliminary enforcement notice over potential failure to properly assess the privacy risks posed by Snap's generative AI chatbot 'My AI'.

The preliminary notice sets out the steps which the Commissioner may require, subject to Snap's representations on the preliminary notice. If a final enforcement notice were to be adopted, Snap may be required to stop processing data in connection with 'My AI'. This means not offering the 'My AI' product to UK users pending Snap carrying out an adequate risk assessment.

Snap launched the 'My AI' feature for UK Snapchat+ subscribers in February 2023, with a roll out to its wider Snapchat user base in the UK in April 2023. The chatbot feature, powered by OpenAI's GPT technology, marked the first example of generative AI embedded into a major messaging platform in the UK. As at May 2023 Snapchat had 21 million monthly active users in the UK.

The ICO's investigation provisionally found the risk assessment Snap conducted before it launched 'My AI' did not adequately assess the data protection risks posed by the generative AI technology, particularly to children. The assessment of data protection risk is particularly important in this context which involves the use of innovative technology and the processing of personal data of 13 to 17 year old children.

The Commissioner's findings in the notice are provisional. No conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that an enforcement notice will ultimately be issued. The ICO will carefully consider any representations from Snap before taking a final decision.

John Edwards, Information Commissioner said:

The provisional findings of our investigation suggest a worrying failure by Snap to adequately identify and assess the privacy risks to children and other users before launching 'My AI'.

We have been clear that organisations must consider the risks associated with AI, alongside the benefits. Today's preliminary enforcement notice shows we will take action in order to protect UK consumers' privacy rights.

The Information Commissioner's Office (ICO) and Ofcom have set out how we will work together to ensure coherence between the data protection and the new online safety regimes.

Our joint statement builds on our existing cooperative approach to regulation - and on our close working relationship established as co-founders of the Digital Regulation Cooperation Forum.

In anticipation of Ofcom taking on new duties in 2023 under the Online Safety Bill, the statement sets out our shared regulatory aims. We want:

• people who use online services to have confidence that their safety and privacy will be upheld and that we will take prompt and effective action when providers fail in their obligations; and

• providers of online services of all sizes to comply with their obligations and to continue to innovate and grow, supported by regulatory clarity and free from undue burden.

To achieve this, the ICO and Ofcom will work closely together to achieve maximum alignment and consistency between the data protection and online safety regimes. We will:

• maximise coherence by ensuring our policies are consistent with each other's regulatory requirements -- and consult closely when preparing codes and guidance. We will seek solutions that enhance users' safety and preserve their privacy. Where there are tensions between privacy and safety objectives, we will provide clarity on how compliance can be achieved with both regimes; and

• promote compliance by setting clear expectations for industry on what they must do to meet both their online safety and data protection requirements. That includes particular support through the transition for small and emerging firms to help them thrive and grow. We will take action against services that don't meet their obligations, sharing information and intelligence as appropriate and coordinating approaches to enforcement.

The UK's data protection censors at the Information Commissioner's Office ICO have generated a disgracefully onerous red tape nightmare called the Age Appropriate Design Code that requires any internet service that provides any sort of grown up content to evaluate the age of all users so that under 18s can be protected from handing over sensitive ID data. Of course the age checking usually requires all users to hand over lots of sensitive and dangerous ID data to any website that asks.

Now the ICO has decided to make these requirements of porn sites given that they are often accessed by under 18s. ICO writes:

Next steps

We will continue to evolve our approach, listening to others to ensure the code is having the maximum impact.

For example, we have seen an increasing amount of research (from the NSPCC, 5Rights, Microsoft and British Board of Film Classification), that children are likely to be accessing adult-only services and that these pose data protection harms, with children losing control of their data or being manipulated to give more data, in addition to content harms. We have therefore revised our position to clarify that adult-only services are in scope of the Children's code if they are likely to be accessed by children.

As well as engaging with adult-only services directly to ensure they conform with the code, we will also be working closely with Ofcom and the Department for Digital, Culture, Media and Sport (DCMS) to establish how the code works in practice in relation to adult-only services and what they should expect. This work is continuing to drive the improvements necessary to provide a better internet for children.

Internet censors of the Information Commissioner's Office has been called on to implement a full-scale probe into how the online betting industry is exploiting new technology to profile and target gamblers.

The move follows a complaint by the campiagn group Clean Up Gambling. It alleges that Sky Bet and its partners are creating detailed behavioural profiles of customers and sharing thousands of data points with dozens of third parties.

Clean Up Gambling alleges that one advertising partner, Signal, owned by TransUnion, has a dossier of 186 attributes for an individual, including their propensity to gamble, their favourite games and their susceptibility to specific types of marketing.

TransUnion said it assists gambling companies in preventing fraud, confirming age and identity, checking affordability and protecting vulnerable customers, to support responsible gambling.

Culture Secretary Oliver Dowden has announced that John Edwards is the Government's preferred candidate for Information Commissioner.

John Edwards is currently New Zealand's Privacy Commissioner. He will now appear before MPs on the Digital, Culture, Media and Sport Select Committee for pre-appointment scrutiny on 9th September 2021.

It seems that the Government has its eyes on market opportunities related to selling data rather than data protection. Dowden commented:

Data underpins innovation and the global digital economy, everyday apps and cloud computing systems. It allows businesses to trade, drives international investment, supports law enforcement agencies tackling crime, the delivery of critical public services and health and scientific research.

The government is outlining the first territories with which it will prioritise striking data adequacy partnerships now it has left the EU as the United States, Australia, the Republic of Korea, Singapore, the Dubai International Finance Centre and Colombia. It is also confirming that future partnerships with India, Brazil, Kenya and Indonesia are being prioritised.

Estimates suggest there is as much as £11 billion worth of trade that goes unrealised around the world due to barriers associated with data transfers.

The aim is to move quickly and creatively to develop global partnerships which will make it easier for UK organisations to exchange data with important markets and fast-growing economies. T

The government also today names New Zealand Privacy Commissioner John Edwards as its preferred candidate to be the UK's next Information Commissioner, following a global search.

As Information Commissioner and head of the UK regulator responsible for enforcing data protection law, he will be empowered to go beyond the regulator's traditional role of focusing only on protecting data rights, with a clear mandate to take a balanced approach that promotes further innovation and economic growth.

...

It means reforming our own data laws so that they're based on common sense, not box-ticking. And it means having the leadership in place at the Information Commissioner's Office to pursue a new era of data-driven growth and innovation. John Edwards's vast experience makes him the ideal candidate to ensure data is used responsibly to achieve those goals.

The data protection censors at the Information Commissioner's Office have got into the internet censorship game with a new regime that starts on the 2nd September 2021. It's Age Appropriate Design code very much requires an age gated internet in the name of data protection for children, The code itself is not law but ICO claims that is an interpretation of the EU's GDPR (General Data Protection Regulation) law and so carries legal weight.

The code requires that websites hand over their personal data to anyone that asks to verify that they are of sufficient age to hand over their personal data. All in the name of preventing children from handing over their personal data.

And the most immediate impact is that social media websites need to ensure that their users are over the age of 13 before the internet companies can make hay with their personal data.

And in preparation for the new rules Facebook and Instagram have posted substantial blogs laying out new polices on age verification.

Facebook summarised:

Facebook and Instagram weren't designed for people under the age of 13, so we're creating new ways to stop those who are underage from signing up.

We're developing AI to find and remove underaged accounts, and new solutions to verify people's ages.

We're also building new experiences designed specifically for those under 13.

See full article from about.fb.com

Instagram added:

Creating an experience on Instagram that's safe and private for young people, but also fun comes with competing challenges. We want them to easily make new friends and keep up with their family, but we don't want them to deal with unwanted DMs or comments from strangers. We think private accounts are the right choice for young people, but we recognize some young creators might want to have public accounts to build a following.

We want to strike the right balance of giving young people all the things they love about Instagram while also keeping them safe. That's why we're announcing changes we'll make today, including:

• Defaulting young people into private accounts.

• Making it harder for potentially suspicious accounts to find young people.

• Limiting the options advertisers have to reach young people with ads.

See full article from about.instagram.com

CEASE (Centre to End All Sexual Exploitation) is a new morality group campaigning against porn and sex work in the UK.

The group was founded in 2019 and describes itself on its website:

We shine a light on what sexual exploitation is, where it occurs and how it contravenes our human rights. We campaign for new and better laws, advocate for policy change and hold the global sex industry to account.

We're building a UK-wide movement of campaigners against sexual exploitation, and we're amplifying the voices of the very best advocates for change: survivors.

Its latest cunning plan is to hold the Information Commissioners Office (the UK data protection censor) as responsible for failing to prevent the world's porn sites from obtaining usage data from under 18s. The group writes on its website:

We are threatening to take legal action against the Information Commissioner's Office (ICO) for failing to protect children's data from misuse by porn sites.

The excuses the ICO has given for its failure to fulfil its regulatory duties are legally and factually flawed. What's more, it has left children exposed to a profit-hungry industry which is intent on drawing children back again and again to watch violent and abusive pornographic material for its own financial gain.

The group quotes long time porn campaigner John Carr:

I was shocked and dismayed by the Information Commissioner's reply to me in which they refused to act against porn sites which were collecting and processing children's data on a large scale. If the data protection laws weren't designed to protect children ... I am sure a lot of parents will wonder just what they were designed to do.

A survey by the Information Commissioner's Office (ICO) shows that three quarters of businesses surveyed are aware of the impending Children's Code. The full findings will be published in May but initial analysis shows businesses are still in the preparation stages.

And with just six months to go until the code comes into force, the ICO is urging organisations and businesses to make the necessary but onerous changes to their online services and products.

The Children's Code sets out 15 standards organisations must meet to ensure that children's data is protected online. The code will apply to all the major online services used by children in the UK and includes measures such as providing default settings which ensure that children have access to online services whilst minimising data collection and use.

Details of the code were first published in June 2018 and UK Parliament approved it last year. Since then, the ICO has been providing support and advice to help organisations adapt their online services and products in line with data protection law.

In a landmark decison that shines a light on widespread data protecton failings by the entire data broker industry, the UK data protection censor ICO, has taken enforcement action against Experian, based in part on a complaint made by Privacy International in 2018.

Privacy International (PI) welcomes the report from the UK Information Commissioner's Office (ICO) into three credit reference agencies (CRAs) which also operate as data brokers for direct marketing purposes. As a result, the ICO has ordered the credit reference agency Experian to make fundamental changes to how it handles people's personal data within its offline direct marketing services.

Experian now has until July 2021 to inform people that it holds their personal data and how it intends to use it for marketing purposes. The ICO also requires Experian to stop using personal data derived from the credit referencing side of its business by January 2021.

The ICO investigation found widespread and systemic data protection failings across the sector, significant data protection failures at each company and that significant invisible processing took place, likely affecting millions of individuals in the UK. As the report underlines, between the CRAs, the data of almost every adult in the UK was, in some way, screened, traded, profiled, enriched, or enhanced to provide direct marketing services.

Moreover, the report notes that all three of the credit referencing agencies investigated were also using profiling to generate new or previously unknown information about people. This can be extremely invasive and can also have discriminatory effects for individuals.

Experian has said it intends to appeal the ICO decisions saying:

We believe the ICO's view goes beyond the legal requirements. This interpretation (of General Data Protection Regulation) also risks damaging the services that help consumers, thousands of small businesses and charities, particularly as they try to recover from the COVID-19 crisis.

ICO consultation on the draft Statutory guidance

We are running a consultation about an updated version of the Statutory guidance on how the ICO will exercise its data protection regulatory functions of information notices, assessment notices, enforcement notices and penalty notices.

This guidance is a requirement of the Data Protection Act 2018 and only covers data protection law under that Act. Our other regulatory activity and the other laws we regulate are covered in our Regulatory action policy (which is currently under review).

We welcome written responses from all interested parties including members of the public and data controllers and those who represent them. Please answer the questions in the survey and also tell us whether you are responding on behalf of an organisation or in a personal capacity.

We will use your responses to this survey to help us understand the areas where organisations and members of the public are seeking further clarity about information notices, assessment notices, enforcement notices and penalty notices. We will only use this information to inform the final version of this guidance and not to consider any regulatory action.

We will publish this guidance after the UK has left the EU and we have therefore drafted it accordingly.

The ICO issued the code on 12 August 2020 and it will come into force on 2 September 2020 with a 12 month transition period.

Information Commissioner Elizabeth Denham writes:

Data sits at the heart of the digital services children use every day. From the moment a young person opens an app, plays a game or loads a website, data begins to be gathered. Who's using the service? How are they using it? How frequently? Where from? On what device?

That information may then inform techniques used to persuade young people to spend more time using services, to shape the content they are encouraged to engage with, and to tailor the advertisements they see.

For all the benefits the digital economy can offer children, we are not currently creating a safe space for them to learn, explore and play.

This statutory code of practice looks to change that, not by seeking to protect children from the digital world, but by protecting them within it.

This code is necessary.

This code will lead to changes that will help empower both adults and children.

One in five UK internet users are children, but they are using an internet that was not designed for them. In our own research conducted to inform the direction of the code, we heard children describing data practices as nosy, rude and a bit freaky.

Our recent national survey into people's biggest data protection concerns ranked children's privacy second only to cyber security. This mirrors similar sentiments in research by Ofcom and the London School of Economics.

This code will lead to changes in practices that other countries are considering too.

It is rooted in the United Nations Convention on the Rights of the Child (UNCRC) that recognises the special safeguards children need in all aspects of their life. Data protection law at the European level reflects this and provides its own additional safeguards for children.

The code is the first of its kind, but it reflects the global direction of travel with similar reform being considered in the USA, Europe and globally by the Organisation for Economic Co-operation and Development (OECD).

This code will lead to changes that UK Parliament wants.

Parliament and government ensured UK data protection laws will truly transform the way we look after children online by requiring my office to introduce this statutory code of practice.

The code delivers on that mandate and requires information society services to put the best interests of the child first when they are designing and developing apps, games, connected toys and websites that are likely to be accessed by them.

This code is achievable.

The code is not a new law but it sets standards and explains how the General Data Protection Regulation applies in the context of children using digital services. It follows a thorough consultation process that included speaking with parents, children, schools, children's campaign groups, developers, tech and gaming companies and online service providers.

Such conversations helped shape our code into effective, proportionate and achievable provisions.

Organisations should conform to the code and demonstrate that their services use children's data fairly and in compliance with data protection law.

The code is a set of 15 flexible standards 203 they do not ban or specifically prescribe 203 that provides built-in protection to allow children to explore, learn and play online by ensuring that the best interests of the child are the primary consideration when designing and developing online services.

Settings must be high privacy by default (unless there's a compelling reason not to); only the minimum amount of personal data should be collected and retained; children's data should not usually be shared; geolocation services should be switched off by default. Nudge techniques should not be used to encourage children to provide unnecessary personal data, weaken or turn off their privacy settings. The code also addresses issues of parental control and profiling.

This code will make a difference.

Developers and those in the digital sector must act. We have allowed the maximum transition period of 12 months and will continue working with the industry.

We want coders, UX designers and system engineers to engage with these standards in their day-to-day to work and we're setting up a package of support to help.

But the next step must be a period of action and preparation. I believe companies will want to conform with the standards because they will want to demonstrate their commitment to always acting in the best interests of the child. Those companies that do not make the required changes risk regulatory action.

What's more, they risk being left behind by those organisations that are keen to conform.

A generation from now, I believe we will look back and find it peculiar that online services weren't always designed with children in mind.

When my grandchildren are grown and have children of their own, the need to keep children safer online will be as second nature as the need to ensure they eat healthily, get a good education or buckle up in the back of a car.

And while our code will never replace parental control and guidance, it will help people have greater confidence that their children can safely learn, explore and play online.

There is no doubt that change is needed. The code is an important and significant part of that change.

ICO statement in response to the Government laying the Age Appropriate Design Code, also known as the Children's Code, before Parliament.

We welcome the news that Government has laid the Age Appropriate Design Code before Parliament. It's a huge step towards protecting children online especially given the increased reliance on online services at home during COVID-19.

The code sets out 15 standards that relevant online services should meet to protect children's privacy and is the result of wide-ranging consultation and engagement with stakeholders including the tech industry, campaigners, trade bodies and organisations.

We are now pulling together our existing work on the benefits and the costs of the code to assess its impact. This will inform the discussions we have with businesses to help us develop a package of support to help them implement the code during the transition year."

The Age Appropriate Design Code has been written by the Information Commissioner's Office (ICO) to inform websites what they must do to keep ICO internet censors at bay with regards to the government's interpretations of GDPR provisions. Perhaps in the same way that the Crown Prosecution Service provides prosecution guidance as to how it interprets criminal law.

The Age Appropriate Design Code dictates how websites, and in particular social media, make sure that they are not exploiting children's personal data. Perhaps the most immediate effect is that social media will have to allow a level of usages that simply does not require children to hand over personal data. Requiring more extensive personal data, say in the way that Facebook does, requires users to provide 'age assurance' that they are old enough to take such decisions wisely.

However adult users may not be so willing to age verify, and may in fact also appreciate an option to use such websites without handing over data into the exploitative hands of social media companies.

So one suspects that US internet social media giants may not see Age Appropriate Design and the government's Online Harms model for internet censorship as commercially very desirable for their best interests. And one suspects that maybe US internet industry pushback may be something that is exerting pressure on UK negotiators seeking a free trade agreement with the US.

Pure conjecture of course, but the government does seem very cagey about its timetable for both the Age Appropriate Design Code and the Online Harms bill. Here is the latest parliamentary debate in the House of Lords very much on the subject of the government's timetable.

House of Lords Hansard: Age-appropriate Design Code, 18 May 2020

Lord Stevenson of Balmacara:

To ask Her Majesty's Government when they intend to lay the regulation giving effect to the age- appropriate design code required under section 123 of the Data Protection Act 2018 before Parliament.

The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Baroness Barran) (Con)

The age-appropriate design code will play an important role in protecting children's personal data online. The Government notified the final draft of the age-appropriate design code to the European Commission as part of our obligations under the technical standards and regulations directive. The standstill period required under the directive has concluded. The Data Protection Act requires that the code is laid in Parliament as soon as is practicably possible.

Lord Stevenson of Balmacara:

I am delighted to hear that, my Lords, although no date has been given. The Government have a bit of ground to make up here, so perhaps it will not be delayed too long. Does the Minister agree that the Covid-19 pandemic is a perfect storm for children and for young people's digital experience? More children are online for more time and are more reliant on digital technology. In light of that, more action needs to be taken. Can she give us some information about when the Government will publish their final response to the consultation on the online harms White Paper, for example, and a date for when we are likely to see the draft Bill for pre-legislative scrutiny?

Baroness Barran

I spent some time this morning with a group of young people, in part discussing their experience online. The noble Lord is right that the pandemic presents significant challenges, and they were clear that they wanted a safe space online as well as physical safe spaces. The Government share that aspiration. We expect to publish our response to the online harms consultation this autumn and to introduce the legislation this Session.

Lord Clement-Jones (LD)

My Lords, I was very disappointed to see in the final version of the code that the section dealing with age-appropriate application has been watered down to leave out reference to age-verification mechanisms. Is this because the age-verification provisions of the Digital Economy Act have been kicked into the long grass at the behest of the pornography industry so that we will not have officially sanctioned age-verification tools available any time soon?

Baroness Barran

There is no intention to water down the code. Its content is the responsibility of the Information Commissioner, who has engaged widely to develop the code, with a call for evidence and a full public consultation.

Lord Moynihan (Con)

My Lords, is my noble friend the Minister able to tell the House the results of the consultation process with the industry on possible ways to implement age verification online?

Baroness Barran

We believe that our online harms proposals will deliver a much higher level of protection for children, as is absolutely appropriate. We expect companies to use a proportionate range of tools, including age-assurance and age-verification technologies, to prevent children accessing inappropriate behaviour, whether that be via a website or social media.

The Earl of Erroll (CB)

May I too push the Government to use the design code to cover the content of publicly accessible parts of pornographic websites, since the Government are not implementing Part 3 of the Digital Economy Act to protect children? Any online harms Act will be a long time in becoming effective, and such sites are highly attractive to young teenagers.

Baroness Barran

We agree absolutely about the importance of protecting young children online and that is why we are aiming to have the most ambitious online harms legislation in the world. My right honourable friend the Secretary of State and the Minister for Digital and Culture meet representatives of the industry regularly to urge them to improve their actions in this area.

Lord Holmes of Richmond (Con)

My Lords, does my noble friend agree that the code represents a negotiation vis-Ã -vis the tech companies and thus there is no reason for any delay in laying it before Parliament? Does she further agree that it should be laid before Parliament before 10 June to enable it to pass before the summer break? This would enable the Government to deliver on the claim that the UK is the safest place on the planet to be online. Share The edit just sent has not been saved. The following error was returned: This content has already been edited and is awaiting review.

Baroness Barran

The negotiation is not just with the tech companies. We have ambitions to be not only a commercially attractive place for tech companies but a very safe place to be online, while ensuring that freedom of speech is upheld. The timing of the laying of the code is dependent on discussions with the House authorities. As my noble friend is aware, there is a backlog of work which needs to be processed because of the impact of Covid-19.

The Information Commissioner's Office (ICO) has announced:

The ICO recently set out its regulatory approach during the COVID-19 pandemic, where we spoke about reassessing our priorities and resources.

Taking this into account we have made the decision to pause our investigation into real time bidding and the Adtech industry.

It is not our intention to put undue pressure on any industry at this time but our concerns about Adtech remain and we aim to restart our work in the coming months, when the time is right.

The Information Commissions Office (ICO) earlier in the year presented draft internet censorship laws targeted at the commendable aim of protecting the personal data of younger website users. These rules are legally enforceable under the EU GDPR and are collectively known as The Age Appropriate Design Code.

The ICO originally proposed that website designers should consider several age ranges of their users. The youngest users should be presented with no opportunity to reveal their personal data and then the websites could relent a little on the strictness of the rules as they get older. It all sounds good at first read... until one considers exactly how to know how old users are.

And of course ICO proposed age verification (AV) to prove that people are old enough for the tier of data protection being applied.

ISO did not think very hard about the bizarre contradiction that AV requires people to hand over enough data to give identity thieves an orgasm. So the ICO were going to ask people to hand over their most sensitive ID to any websites that ask... in the name of the better protection of the data that they have just handed over anyway.

The draft rules were ridiculous, requiring even a small innocent site with a shopping trolley to require AV before allowing people to type in their details in the shopping trolley.

Well the internet industry strongly pointed out the impracticality of the ICO's nonsense ideas. And indeed the ICO released a blog and made a few comments that suggest it would be scaling back on its universal AV requirements.

The final censorship were delivered to the government on schedule on 23rd November 2019.

The industry is surely very keen to know if the ICO has retreated on its stance, but the ICO has now just announced that the publication date will be delayed until the next government is in place. It sounds that their ideas may still be a little controversial, and they need to hide behind a government minister before announcing the new rules.

In recent months we've been reviewing how personal data is used in real time bidding (RTB) in programmatic advertising, engaging with key stakeholders directly and via our fact-finding forum event to understand the views and concerns of those involved.

We're publishing our Update report into adtech and real time bidding which summarises our findings so far.

We have prioritised two areas: the processing of special category data, and issues caused by relying solely on contracts for data sharing across the supply chain. Under data protection law, using people's sensitive personal data to serve adverts requires their explicit consent, which is not happening right now. Sharing people's data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data.

We recognise the importance of advertising to participants in this commercially sensitive ecosystem, and have purposely adopted a measured and iterative approach to our review of the industry as a whole so that we can observe the market's reaction and adapt our thinking. However, we want to see change in how things are done. We'll be spending the next six months continuing to engage with the sector, which will give the industry the chance to start making changes based on the conclusions we've come to so far.

Open Rights Group responds

25th June 2019. See article from openrightsgroup.org

The ICO has responded to a complaint brought by Jim Killock and Dr Michael Veale in Europe's 12 billion euro real-time bidding adtech industry. Killock and Veale are now calling on the ICO to take action against companies that are processing data unlawfully.

The ICO has agreed in substance with the complainants' points about the insecurity of adtech data sharing. In particular, the ICO states that:

• Processing of non-special category data is taking place unlawfully at the point of collection

• [The ICO has] little confidence that the risks associated with RTB have been fully assessed and mitigated

• Individuals have no guarantees about the security of their personal data within the ecosystem

However the ICO is proceeding very cautiously and slowly, and not insisting on immediate changes, despite the massive scale of the data breach.

Jim Killock said:

The ICO's conclusions are strong and very welcome but we are worried about the slow pace of action and investigation. The ICO has confirmed massive illegality on behalf of the adtech industry. They should be insisting on remedies and fast.

Dr Michael Veale said:

The ICO has clearly indicated that the sector operates outside the law, and that there is no evidence the industry will correct itself voluntarily. As long as it remains doing so, it undermines the operation and the credibility of the GDPR in all other sectors. Action, not words, will make a difference--and the ICO needs to act now.

The ICO concludes:

Overall, in the ICO's view the adtech industry appears immature in its understanding of data protection requirements. Whilst the automated delivery of ad impressions is here to stay, we have general, systemic concerns around the level of compliance of RTB:

• Processing of non-special category data is taking place unlawfully at the point of collection due to the perception that legitimate interests can be used for placing and/or reading a cookie or other technology (rather than obtaining the consent PECR requires).
• Any processing of special category data is taking place unlawfully as explicit consent is not being collected (and no other condition applies). In general, processing such data requires more protection as it brings an increased potential for harm to individuals.
• Even if an argument could be made for reliance on legitimate interests, participants within the ecosystem are unable to demonstrate that they have properly carried out the legitimate interests tests and implemented appropriate safeguards.
• There appears to be a lack of understanding of, and potentially compliance with, the DPIA requirements of data protection law more broadly (and specifically as regards the ICO's Article 35(4) list). We therefore have little confidence that the risks associated with RTB have been fully assessed and mitigated.
• Privacy information provided to individuals lacks clarity whilst also being overly complex. The TCF and Authorized Buyers frameworks are insufficient to ensure transparency and fair processing of the personal data in question and therefore also insufficient to provide for free and informed consent, with attendant implications for PECR compliance.
• The profiles created about individuals are extremely detailed and are repeatedly shared among hundreds of organisations for any one bid request, all without the individuals' knowledge.
• Thousands of organisations are processing billions of bid requests in the UK each week with (at best) inconsistent application of adequate technical and organisational measures to secure the data in transit and at rest, and with little or no consideration as to the requirements of data protection law about international transfers of personal data.
• There are similar inconsistencies about the application of data minimisation and retention controls.
• Individuals have no guarantees about the security of their personal data within the ecosystem.

The Information Commissioner's Office has for some bizarre reason have been given immense powers to censor the internet.

And in an early opportunity to exert its power it has proposed a 'regulation' that would require strict age verification for nearly all mainstream websites that may have a few child readers and some material that may be deemed harmful for very young children. Eg news websites that my have glamour articles or perhaps violent news images.

In a mockery of 'data protection' such websites would have to implement strict age verification requiring people to hand over identity data to most of the websites in the world.

Unsurprisingly much of the internet content industry is unimpressed. A six weerk consultation on the new censorship rules has just closed and according to the Financial Times:

Companies and industry groups have loudly pushed back on the plans, cautioning that they could unintentionally quash start-ups and endanger people's personal data. Google and Facebook are also expected to submit critical responses to the consultation.

Tim Scott, head of policy and public affairs at Ukie, the games industry body, said it was an inherent contradiction that the ICO would require individuals to give away their personal data to every digital service.

Dom Hallas, executive director at the Coalition for a Digital Economy (Coadec), which represents digital start-ups in the UK, said the proposals would result in a withdrawal of online services for under-18s by smaller companies:

The code is seen as especially onerous because it would require companies to provide up to six different versions of their websites to serve different age groups of children under 18.

This means an internet for kids largely designed by tech giants who can afford to build two completely different products. A child could access YouTube Kids, but not a start-up competitor.

Stephen Woodford, chief executive of the Advertising Association -- which represents companies including Amazon, Sky, Twitter and Microsoft -- said the ICO needed to conduct a full technical and economic impact study, as well as a feasibility study. He said the changes would have a wide and unintended negative impact on the online advertising ecosystem, reducing spend from advertisers and so revenue for many areas of the UK media.

An ICO spokesperson said:

We are aware of various industry concerns about the code. We'll be considering all the responses we've had, as well as engaging further where necessary, once the consultation has finished.