Main background information
In the last weeks of June, it can be noticed that two European Data Protection Authorities focused their attention on the subject of 'Programmatic Advertising'; namely, the Information Commissioner's Office ("ICO")1 in the United Kingdom, and the Commission Nationale de l'Informatique et des Libertés ("CNIL")2 in France. Moreover, the CNIL recently rendered a formal notice to a company which was carrying out targeted advertising through the use of Programmatic Advertising technologies, in order to warn it that if it does not comply with the applicable data protection law within three months, it would be subject to a sanction. The critical aspects of the processing that were identified by the CNIL derive from (i) the lack of transparency in the information relating to the processing that the company was providing, as well as the text utilised to collect consent from the data subjects, (ii) the collection of a single consent to carry out multiple processing activities, and (iii) the unlawful disclosure of personal data to third parties.
Programmatic Advertising is an automated mechanism for the purchase and sale of advertising space online through computer platforms. This transaction is based almost exclusively on the analysis of personal data of the recipients of the advertising content, on the basis of which the allocation of such spaces takes place. Be cautious - there should be no overlap between Programmatic Advertising and Real Time Bidding ("RTB"), as the latter is only a specification of the former. In fact, the RTB is nothing more than a real time auction, between a publisher and indefinite advertisers (when the auction is open and not private), with its object being the online advertising space. Additionally, the auction is based on the personal data of the internet user, which is collected by the publisher through a set of technologies that operate directly on the browser and/or on the user's device. The personal data constitutes the content of the so-called bid request, a real proposal launched by the publishers, or rather by their intermediaries, to the advertiser basin. Therefore, it follows that the more detailed the bid requests are, the higher the advertiser's offer for the purchase of the advertising space visible to that specific end user will be (since the conversion rate for their advertisement can be much higher).
It is therefore understandable why the two Supervisory Authorities felt there was a need to express an opinion on the implications of these processes, raising several profound criticalities of the system in relation to the legislation of the European Regulation 2016/679 (GDPR or "Regulation). As will be seen in greater detail below, but as can be perfectly understood from the documents published by the Authorities, the main issues that the system presents with respect to the provisions of the law are linked to the obligations of transparency, the lawfulness of...