ORG briefing to DCMS on PECR reform

ORG believe the status quo of the real-time-bidding  ecosystem is unsustainable. Our answer to the ICO call for views, which was also reflected in the ICO summary of public views, was that:

“tracking, profiling and targeting of people based on personal data exposes exposes women to unjust prosecutions for their attempt to exercise reproductive health rights; problem gamblers to being targeted with gambling ads that are meant to exploit their addiction; anyone to be excluded on the basis of their gender, sexual preferences, ethnicity or other sensitive characteristics; children and those in a more vulnerable status to be targeted and taken advantage of.”

Thus, we recognise the need to promote change in the online advertising sector, and support efforts to shift industry away from the dominant model of online advertising, i.e. behavioural advertising and the real-time-bidding ecosystem. It follows that we do not oppose in principle a reform of the cookie consent regime.

For this change to be meaningful and to address the issues outlined above, we identify the following, necessary conditions:

• Legislation must seek to promote new data practices that: do not identify or target users on the basis of their personal data; minimise the amount of data collected to deliver advertising; reduce the onward sharing of data within the adtech ecosystem; restores users’ agency.

• New exemptions must never allow behavioural profiling, i.e. tracking and/or targeting Internet users on the basis of their online activity or personal data.
• Data collected under any new exemption should be minimised, and must not become available for further use that exceeds the purposes of the exemptions.
• Legislative reform can work only if Internet users are given agency, ie.e meaningful and effective means to reject behavioural profiling and advertising. Likewise, law-breakers need be punished for non-compliance, privacy violations, and cohercion.

WHY THESE RED LINES ARE IMPORTANT

A reform is needed to curb mass violation of privacy and data protection rights from the adtech industry. It follows that legislative change ought to accommodate privacy-respecting advertising solutions, address the privacy issues of online advertising substantively, and reward advertisers who choose to employ them. On the other hand, the reform must not to legalise existing, unlawful practices: this would reward non-compliance and fail to promote the behavioural shift that is badly needed within the industry.

To achieve the above, any new exemption cannot cover data processing for behavioural advertising and profiling in any way. Minimising the amount of data collected, and preventing data from being further used beyond the purpose of such exemptions, is also necessary to address the broader issues of onward sharing, opacity and lack of security that characterise the real-time-bidding ecosystem.

Further, if individuals are not able to choose freely, the adtech industry will focus on force them to agree to behavioural advertising, rather than to innovate and develop new practices that take advantage of the new exemptions. A meaningful reform of PECR need to establish means that individuals can use to express their consent choices effectively. If such means are not provided, the adtech industry will, as their track record shows, coerce individuals into submitting to behavioural profiling, thus killing the adoption of new privacy-preserving advertising solutions.

It also follows that intermediaries that violate users’ privacy or prevent them from exercising their agency need be punished, so that they are put at a disadvantage against those advertisers who choose to deploy privacy-respecting solutions and to respect users’ agency.

ORG do not, in principle, oppose the exemptions envisioned by the ICO in their advice to government. We do, however, emphasise that new exemptions need not becoming a backdoor to legalise behavioural profiling and targeting. We are also mindful that the adtech industry has an established track record of non-compliance, law-breaking and mass violation of users’ rights. To address these issues:

• Wording will need to be clear and restrictive, to avoid expansive interpretation by the adtech industry and abuse by bad-faith actors, which are dominant.
• Safeguards will need to be put in place to prohibit reusing data covered by any new exemptions for reasons that exceed the purpose an exemption was granted for. Likewise, legislation must not allow to process this data for fingerprinting, re-identification, de-anonymisation, or data enhancement (i.e. the use of data broking services to link data processed under an exemption to other, commercially available personal data).
• A strict application of data minimisation and necessity will also be needed, to support these safeguards: the less data is available, the less granular the data is, and the more difficult it is to re-link such data to the original user; the more technically difficult it will be for the toxic advertising systems to re-introduce these data into their ecosystem.

We also note that:

• Legitimate interest is likely to become the basis for processing data under the new exemptions. The balancing test is a self-assessment with a regulatory backstop threat: in other words, controllers are asked to self-regulate, under the threat of regulatory intervention if they fail to do so. Widespread bad-faith across the industry means that the balancing test would likely be abused, and thus be insufficient to protect data in this scenario.
• Consent-based cookie tracking means that, where such consent was not given or withdrawn, continued processing of that data under another legal basis (such as legitimate interest) would have been unfair and thus breached the principle of fairness. However, fairness does not necessarily constitute a meaningful restriction against data reuse in a scenario where data processing can happen without users’ consent.

Hence, we believe legislation should enshrine prohibitions and prescriptive limits against further processing (data reuse, fingerprinting, re-identification, de-anonymisation, or data enhancement) in order to provide meaningful protection against data misuse. These additional safeguards should complement, and not derogate, principle-based provisions that UK data protection law already enshrines.

Any new exemption can favour privacy-preserving advertising solutions only and insofar users are allowed to express their choices freely, and thus choose the more privacy-friendly option instead of the privacy-invasive one. However, the adtech industry has for years deployed tactics to coerce users to choose what is preferable for the adtech industry: for instance with deceptive cookie banners, dark patterns, consent spam, etc.

Thus, this new policy to be successful only if supported by legislative measures that restore users’ right to choose freely. The obvious way to achieve this would be giving legal enforceability to browsers signals: users would be able to express their choices within their browsers, and these choices would then be communicated automatically every time they visit a website. Browser signals would also give users an avenue to “individually enforce” their choices, as opposed to have to rely on the ICO chasing non-compliant actors and directly promoting change within the sector.

Binding privacy signals also make regulatory enforcement easier and, thus, more likely. Establishing the existence or absence “valid consent” or “coercion” requires a certain degree of discovery: regulators need to investigate data practices and assess if an interface is deceptive, if something is unfair, and later debate this assessment if the controller appeals the ICO decision. Binding privacy signals only require a binary assessment, i.e. has the browser communicated a given preference, and was it respected,. This makes their enforcement much more likely, and the prospect of a successful appeal against it less likely.

The need of browsers signals, as an alternative avenue and a supporting factor to the ICO’s direct regulatory enforcement should also be seen in light of the ICO track record and present state. In particular:

• As the ICO advice to government admits, most of the issues that were identified in the 2019 update adtech report still exists, i.e. the adtech industry hasn’t meaningfully addressed any of the radical violations of data protection law that were identified by the ICO and their report in 2019. Seven years have passed since then, but the ICO has yet to take any enforcement action against the adtech industry.
• The ICO are currently undergoing a transition from a corporate solo to a statutory board, a move of their headquarters to Manchester, turnover of their leadership, and an independent review due to the resignation of former Commissioner John Edwards following an internal HR investigation.

There is little to suggest an imminent step-change in the ICO regulatory enforcement against the adtech sector, and there is much to suggest the organisation will face substantial management distraction in the short-medium term instead. The combined effect of these factors make it dubious that the ICO will be able to support the implementation of these reforms via strong regulatory intervention. Thus, it would be wise to create alternative avenues, such as binding privacy signals, that can be “individually enforced” by the users themselves.

As we elaborate below, alignment of the UK proposals to the emerging EU framework would also increase regulatory risks for actors who were to breach the new exemptions, as infringements and bad practices would attract regulatory scrutiny not only within the UK but also elsewhere within EU/EEA countries.

Similarly to the UK, the European Union’s Data Omnibus is debating the introduction of limited exemptions to cookie consent requirements, and of a mechanism to formally give legal enforceability to browsers’ signals. The concurrence of this debate and its impact on the UK’s own initiative should not be understated. In particular:

• The UK should seek to align its new exemptions to those introduced in the EU. Concurring rather than competing regulatory frameworks would make an industry shift toward a more privacy-respecting alternative more compelling, as a new advertising system developed for the EU regulatory regime would automatically be deployable in the UK and vice-versa. On the other hand, diverging regulatory requirements would prevent a solution developed for a given regulatory regime to be deployed in the other, thus reducing the overall commercial viability and scalability of such systems.
• Concurring regulatory requirements would increase regulatory risks for non-compliant adtech players: if, for instance, they were to abuse new exemptions provided in the UK, such behaviour could be punished both in the UK and the EU, thus increasing the regulatory risk for non-compliance. On the other hand, if a regulatory requirement only exists in the UK but not the EU, non-compliance would expose law-breaker to a regulatory risk in the UK only, where the likelihood of enforcement is dubious for reasons stated before.

In light of the above, we suggest the government to re-assess the existing timeline for the use of Henry VIII powers to introduce such exemptions. In particular, we believe it would be beneficial to wait for the outcome of the EU data omnibus proposals to minimise the risk of regulatory divergence with the EU, and the potential effect of producing two competing and regimes that mutually undermine the viability of the other. This would not prevent the government from consulting on drafting and policy options, which would still be useful to promote public scrutiny and promote cross-border regulatory dialogue.

The purposes and objectives of these reform can be shared, but the current status-quo and track record within the adtech sector requires realism: the industry is unaccustomed to comply with the law, if not openly rogue and against it. In turn, exceptional measures to force a shift of behaviour across the sector will be needed for this reform to prove effective and achieve its purpose.

Thus, we urge the Department to work on the issues listed above, and we remain available for further engagement on this subject.