AdTech Data Breach GDPR Complaint Heads to EU Court

Digital Advertising Practices Face Legal Challenge in Germany

The IAB Tech Labs, a New York-based organization setting standards for digital advertising, is now the subject of legal action in Germany. The Irish Council for Civil Liberties (ICCL) initiated this privacy litigation, focusing on the real-time bidding (RTB) process – a rapid online ad auction.

The Scope of the Lawsuit

This case extends beyond a single entity, encompassing the entire “data industrial complex” within the adtech sector. Both major corporations like Google and Facebook, and smaller adtech companies and data brokers, are implicated. These entities profit by creating user profiles and selling access to their attention through online ad auctions that utilize RTB.

A Whistleblower's Perspective

Dr. Johnny Ryan, a former adtech professional and current senior fellow at the ICCL, is the driving force behind the lawsuit. He characterizes RTB as the largest data breach in history. He highlights the IAB Tech Lab’s taxonomy documents, which categorize internet users based on sensitive information gathered from their browsing activity.

Concerns Regarding Data Security

The lawsuit asserts that industry documentation confirms a lack of technical safeguards to restrict how companies utilize personal data or with whom they share it. This inherent lack of security within the RTB process raises concerns that unauthorized parties could intercept user information, violating EU data protection laws.

GDPR and the Core of the Issue

Ryan and others have consistently raised concerns about RTB’s security for years, arguing it violates a fundamental principle of the General Data Protection Regulation (GDPR). The GDPR mandates that personal data be processed securely, protecting against unauthorized access and accidental loss – a standard they contend RTB fails to meet.

Frustration with Data Protection Agencies

Despite repeated complaints, European data protection agencies have not taken sufficient action. Consequently, Ryan, through the ICCL, has pursued legal action as a more direct approach to protecting individuals’ rights.

Delayed Response from the Irish DPC

Ryan notes that the Irish Data Protection Commission (DPC), Google’s lead data supervisor in the EU, has yet to issue a statement regarding his RTB complaint filed in 2018. Although the DPC initiated a formal investigation into Google’s adtech in May 2019, the case remains unresolved.

The Rise of Privacy Litigation

Since the GDPR’s implementation in May 2018, privacy lawsuits have increased, including class action suits. This trend has attracted litigation funders seeking opportunities arising from the enforcement gap created by under-resourced and cautious data protection regulators.

Similar Action in the UK

A comparable complaint lodged with the U.K.’s Information Commissioner’s Office (ICO) also resulted in a lawsuit – in that instance, against the ICO itself for inaction. The ICO indicated that audits of the adtech industry were planned.

The Power of Data Protection Authorities

Ryan emphasizes the potential power of GDPR and data protection authorities. He believes they should protect citizens without requiring them to be overly cautious or well-informed about data practices. These authorities possess the power to access documents, premises, and compel companies to cease unlawful data processing.

A Call for Action

Ryan expresses regret that litigation was necessary, stating that data protection authorities should have proactively safeguarded citizens’ rights. He believes this lawsuit could be a significant step towards ending the problematic use of personal data within RTB.

Jurisdiction and Legal Strategy

The lawsuit was filed in Germany because IAB Tech Labs, despite being based in New York, has a representation (a consultancy) within the country. This establishes a legal basis for litigating the case at the Landgerichte, Hamburg.

A Persistent Advocate

Ryan remains committed to raising awareness about RTB’s issues and pursuing legal avenues to ensure the adtech industry adopts more responsible data practices. He stresses the need for genuine reform, rather than superficial rebranding efforts.

Potential Impact and Future Outlook

Ryan anticipates the case may ultimately reach the European Court of Justice (ECJ), a process that could take years. However, he believes the industry will recognize the need for reform long before that point.

IAB Tech Labs' Response

A spokesperson for IAB Tech Labs stated that they have been contacted for comment on the ICCL’s lawsuit.

Broader Concerns About Behavioral Advertising

Last year, the European Parliament called for stricter controls on behavioral advertising, advocating for less intrusive, contextual advertising methods that do not rely on mass surveillance.

Google's "Privacy Sandbox" and Ongoing Criticism

Even Google has proposed phasing out tracking cookies in favor of its “Privacy Sandbox” technology. However, this alternative – targeting users based on shared interests derived from browsing history – has faced criticism for potentially exacerbating predatory ad targeting.

Challenges to the IAB's Consent Framework

The IAB is also facing legal challenges regarding its Transparency and Consent Framework (TCF), a widely used system for obtaining user consent for ad tracking. Belgium’s data protection agency found that the TCF fails to meet GDPR standards.

Pending Verdict on the TCF

The case concerning the TCF is currently before the Belgian litigation chamber, with a verdict and potential enforcement action pending.