Launching Inline's new Data Policy Tracker

In the first of our new regular Data Policy Trackers we cover the key political and regulatory changes, trends and developments impacting the data sector. 

Following on from our report last month, which looked at how the industry is responding to the new data protection regime, our new regular Data Policy Tracker will place the latest interventions from regulators, policymakers and politicians within the context of the evolving data policy landscape. 

In this first edition we explore:

• competition authorities grappled with monopolisation of data and unfair competition;

• policymakers and regulators look ahead to the European elections in May, giving further guidance on the use of data in political campaigns;

• the extent to which the proliferation of tracking cookies are under renewed spotlight; 

• the UK’s new data ethics body launches its work programme, targeting online ads and algorithm bias; and

• regulators rule on what is 'proportionate effort' within the legitimate interest lawful basis for processing data under GDPR.  

You can receive the Data Policy Tracker direct to your inbox by subscribing here and you can read the first edition below. We would love to hear your feedback on this Tracker and about any particular issues you would like to see covered in future editions, please do get in touch, or leave a comment at the bottom of the post.

UK competition authority will initiate a market study of the digital advertising industry

European competition authorities start flexing their muscles, citing data as the key reason for increased scrutiny and fines. 

Following a report by the Digital Competition Expert Panel, the UK Chancellor Philip Hammond has written to the Competition & Markets Authority (CMA) requesting a formal Market Study into the digital advertising industry. The study seeks to develop an understanding of the operation of platform markets which rely on digital advertising for revenue. It will also support the CMA’s ability to adequately assess digital mergers and the possible problems to such mergers in the future.

The Digital Competition Expert Panel report into ‘unlocking digital competition’ that prompted the response concluded that tech giants do not face enough competition, consequently reducing consumer choice and innovation. The report urged the UK Government to increase competition in the digital sector by setting up a new competition unit and strengthening outdated laws. The government is expected to formally respond to this recommendation in the summer.

The report follows a growing interest from competition authorities into the perceived monopolistic practices of large US tech companies, with a particular focus on data. Margrethe Vestager, EU competition commissioner, issued a €1.5bn fine against Google for unfair use of the advertising services of its rivals. The German Federal Cartel Office has also warned Facebook against abusing its market dominance for gathering data on users without adequate knowledge or consent for advertising.

Europe turns its attention to the use of data in election campaign 

With less than two months until the European Parliament elections, the EU is eager to clampdown on the misuse of personal data in targeted campaigns.

The now firmly established European Data Protection Board (EDPB) held its eight plenary session on the 12 -13 March in which it made a statement on the use of personal data in the course of political campaigns. It confirmed that solely automated decision-making, including profiling, where the decision significantly affects the user, is restricted.

With Spanish General Elections on 28 April, the Spanish Data Protection Agency (AEPD) has published guidance which specifies what political parties must do to ensure they are processing personal data correctly, citing the GDPR as its basis under which fines can be levied. The main political parties have begun pulling their online advertising campaigns for fear that they will fall foul of the rules.

The European Council has also adopted rules aimed at preventing European political parties from misusing personal data in the upcoming European Parliament elections on the 23-26 May. The new rules amend regulations governing the statute and funding of European political parties and allow for financial sanctions to be imposed where they are found to deliberately influence, or attempt to influence, the outcome of the elections by breaching GDPR. The fine would amount to 5% of the annual budget of the European party or foundation concerned.

The Dutch data regulator leads the way in renewed guidance on tracking cookies

In the absence of the adoption and implementation of the ePrivacy Regulation, European regulators are trying to give clearer guidance on the use of cookies.

The Dutch data regulator, Autoriteit Persoonsgegevens (AP), has issued a statement saying that websites cannot refuse users access if they refuse to accept ‘tracking cookies’. The regulator claims that websites that only give visitors access to their site if they agree to so-called 'tracking cookies' or other similar ways of tracking and recording behaviour are in breach of GDPR rules. 

Data compliance company Cookiebot has published a report investigating the prevalence of advertising tracking cookies on public sector platforms. It found that 89 per cent of official government websites of EU member states contain third-party ad tracking.

ePrivacy Regulation seeks to ban so called ‘tracking walls’ but regulators have been slow to clarify whether GDPR applies this ban without the adoption of the new ePrivacy Regulation. Other countries such as Germany have already gold-plated the current ePrivacy Directive applying a threshold for explicit consent when applying tracking cookies on a user's device.

UK Centre for Data Ethics and Innovation lays out its work programme

The priority for the body is to issue guidance and policy recommendations relating to the personalisation of online content and bias in algorithms. 

The newly formed Centre for Data Ethics and Innovation (CDEI), which the UK Government formed to contribute practical recommendations for the ethical use of data, has published its inaugural work programme. As part of its programme for the coming 12 months, it will conduct two reviews to identify best practice for the responsible use of data-driven technology.

• The first review will focus on online targeting, investigating how data is used to shape people’s online environments via the personalisation and targeting of messages, content and services online. An interim report will be published by Summer 2019, and a final report, including recommendations to government, by December 2019.

• The second, will investigate the issue of algorithmic bias in various sectors, including financial services, local government, recruitment, and crime and justice. An interim report will be published by Summer 2019, with a final report by March 2020.

The CDEI is mandated to engage widely with the public and across sectors. As part of its launch, it has said that it is keen to work with others and explore the ways in which digital technology may enable this engagement.

EU Courts set to judge on what is deemed 'proportionate effort' when processing data under GDPR

A judgement by the Polish Data Protection Authority has taken a very literal meaning of the data processor's obligation to notify all data subjects under the legitimate interest basis for processing data. 

The Polish Personal Data Protection Office (UODO) has fined Swedish-based data analytics / marketing firm Bisnode €220,000 and ordered that it notify up to six million data subjects that personal information it holds is being used for marketing purposes. The UODO claims that Bisnode will not have fully fulfilled its obligations under the legitimate interest basis of processing data in Article 14 of GDPR if it does not reach out to all data subjects. 

Although the final ruling may be decided in the European courts, Bisnode cite the exemption in GDPR that “disproportionate effort” exclude them from having to send postal mail to approximately 5.7 million contacts which do not have an assignable email address or phone number. This ‘grey area’ within the definition of legitimate interest was inevitably going to come to the fore sooner or later, as regulators and data-driven companies clearly have a different opinion of what is seen as proportionate effort. The final ruling could have a significant impact on business practices of the data marketing industry across Europe.