Le Lézard
Classified in: Science and technology, Business
Subjects: SVY, FOR

Regulatory complaint concerning massive, web-wide data breach by Google and other "ad tech" companies under Europe's GDPR; The complaints are being made by Dr Johnny Ryan of Brave, the private web browser, Jim Killock, Executive Director of the Open Rights Group, and Michael Veale of University College London

DUBLIN and LONDON, Sept. 12, 2018 /PRNewswire/ -- Simultaneous complaints have been filed with European data protection authorities against Google and other ad tech firms.

The complaint notifies European regulators of a massive and ongoing data breach that affects virtually every user on the web.

Every time a person visits a website and is shown a "behavioural" ad on a website, intimate personal data that describes each visitor, and what they are watching online, is broadcast to tens or hundreds of companies. Advertising technology companies broadcast these data widely in order to solicit potential advertisers' bids for the attention of the specific individual visiting the website.

A data breach occurs because this broadcast, known as an "bid request" in the online industry, fails to protect these intimate data against unauthorized access. Under the GDPR this is unlawful.

The GDPR, Article 5, paragraph 1, point f, requires that personal data be "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss." If you can not protect data in this way, then the GDPR says you can not process the data.

Bid request data can include the following personal data:

Dr. Ryan said, "There is a massive and systematic data breach at the heart of the behavioral advertising industry. Despite the two year lead-in period before the GDPR, adtech companies have failed to comply. Our complaint should trigger a EU-wide investigation in to the ad tech industry's practices, using Article 62 of the GDPR. The industry can fix this. Ads can be useful and relevant without broadcasting intimate personal data."

The complaint refers to specific tables in the technical specifications of the RTB bid request system used by advertising technology companies, and Google's proprietary RTB system, to show exactly which data are involved (see detail in complaint documents at the bottom of this release).

Article 5 (1) f of the GDPR requires that personal data be "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss." But there is no control over the intimate personal data in RTB bid requests once they have been broadcast.

Ravi Naik, a Partner at ITN Solicitors who worked with David Carroll on the Cambridge Analytica complaint to the UK Information Commissioner, is working on the case.

Mr. Naik said, "We have been instructed by clients in numerous jurisdictions to file complaints concerning the behavioural advertising industry. The complaints have been lodged with a number of data protection authorities, with a request for a Europe-wide investigation into the industry using new powers within the GDPR. Those complaints are significant and the consequences could be far reaching. We are confident that any proper appraisal by the authorities of the concerns will lead to a fundamental shift in our relationship with the internet, for the better."

The complaint - filed simultaneously with the Irish Data Protection Commissioner and the UK Information Commissioner - requests joint supervisory investigation by European Regulators under Article 62 of the GDPR. This appears to be the first action of this nature since the application of the GDPR.

Mr. Killock said, "The online ad industry is opaque and needs investigation. People do not ? and cannot ? fully understand or know how and where their data is used. This seems highly unethical, and does not square with Europe's data protection laws."

Files submitted in this complaint:


These press releases may also interest you

at 16:33
Trading resumes in / Reprise des négociations pour : Company / Société :THE FLOWR CORPORATION  formerly ?The Needle Capital Corp.'TSX-Venture Symbol / Symbole à la Bourse de croissance TSX :FLWR  formerly ?NEDL.P'Resumption Time (ET)...

at 16:31
The historic Prague Castle was the venue for a frank and fruitful discussion on how China and the countries of Central and Eastern Europe can work together to drive mutual economic growth. Attended by about 200 participants, the event saw keynote...

at 16:30
Scientific Games Corporation ("Scientific Games" or the "Company") announced today a new, exclusive three-year contract for lottery instant "scratch" games with one of the world's leaders in gaming, hospitality and entertainment, Hard Rock...

at 16:30
ONEOK, Inc. today announced plans to construct additional natural gas liquids (NGL) and natural gas infrastructure, including: A new 125,000-barrel per day (bpd) NGL fractionator ? MB-5 ? in Mont Belvieu, Texas, and related infrastructure. A new...

at 16:30
CLPS Incorporation (the "Company" or "CLPS") , a leading information technology ("IT") consulting and solutions service provider focusing on the banking, insurance and financial sectors in China and globally, today announced its financial results for...

at 16:29
Finzat Block, a blockchain solution provider and a Block One Capital portfolio company, and THC, a nationally recognized leader in Asset-Liability Management and whole loan trading, have agreed to combine THC's loan trading network with Finzat's...

News published on 12 september 2018 at 18:56 and distributed by: