Please contact us if you would like to discuss how we might share this experience with you and your students.
Right to Privacy
Questions and answers
1 What is real-time bidding?
Real-time bidding systems are the bedrock of the online advertising industry today.
These systems are based on collecting large amounts of often sensitive information about a person without their consent, such as their personal browsing history, which may reveal their sexual preferences or where they have been, and broadcasting that data to hundreds if not thousands of companies.
Companies wanting to advertise their products then bid in real-time to place their individual adverts in front of a person’s eyes when that person opens a website. When that person sees an advert online on a shopping or news website, there is a high chance that the advert has been placed there based on a broadcast of their personal data over the internet.
2 Who is behind this bidding system?
There are two big players behind this online advertising method: Google and Interactive Advertising Bureau (IAB).
The IAB is the standards body and trade lobby group of the global advertising technology industry. All significant ad tech companies are members. The IAB has local franchises across the globe. Its standards-setting organisation is IAB TechLab.
3 Why is it a problem?
Effectively, there is no data protection built into the system and, as citizens, we have lost control over who has access to our data and how it is used.
Real-time bidding happens without people being aware that it happens, without them being able to consent or dissent, and without them being empowered to do anything about it.
The overriding commercial incentive for many ad tech companies is to share as much data with as many partners as possible. And there are no technical measures that prevent the recipient of a bid request from, for example, combining them with other data to create a profile, or from selling the data on.
This enables an organisation to discriminate against you, or interfere with your fundamental rights — for instance, it may reveal your political opinions to your employer, or your habits and lifestyle to an insurance company. Also, some governments have used this data to track your movements and know if you took part in a rally or a strike, or if you have complied with coronavirus restrictions.
For more information on the technicalities of how real-time bidding works, please consult this detailed report from Dr Johnny Ryan (pages 3-7).
4 What has been done to protect privacy so far?
4.1 2018 complaints
The first complaints on adtech were filed against Google and the IAB in September 2018 by Dr. Johnny Ryan in Ireland, and Open Rights Group and Dr. Michael Veale in the UK.
The UK Information Commissioner’s Office (ICO) investigated the unlawful practices of the AdTech industry but, despite finding unlawful practices, decided to close the investigation in September 2020 without taking any action.
Even though the Irish Data Protection Commissioner (DPC) opened a statutory investigation into Google and the Belgian Data Protection Authority (DPA) initiated an investigation into the IAB, the initiators of the complaint had no information until recently on the next meaningful steps of the investigation.
4.2 2019 complaints
During 2019, the same complaint was filed with national data protection authorities in 13 additional EU countries.
There were many inconsistencies in how different data protection authorities reacted to the complaints submitted in the last two years: most authorities referred complaints to lead supervisory authorities in Ireland and in Belgium, some began their own investigations, others failed to react at all, while a few dismissed the case.
In October 2020, the Belgian authority notified certain complainants about its investigation, but a number of earlier complainants did not receive any news. The reasons are unclear. As a result, the consortium of Liberties, the Open Rights Group (ORG) and the Panoptykon Foundation will liaise with the relevant national data protection authorities about this issue in the coming days.
4.3 Today’s complaints
Today’s complainants have explicitly asked their national authorities to refer the case to the lead authorities and to work together with them in protecting European citizens from the unlawful practices of the AdTech industry.
Instead of relying on unlawful profiling, the industry should move towards an improved model of online advertising which upholds the law and actively protects people’s personal data.
5 Can the GDPR do the job?
The General Data Protection Regulation (GDPR) is a landmark piece of legislation which on paper rebalances people’s right to privacy online with the interests of companies. It is quite possible that the GDPR can solve the problems of real-time bidding.
However, it suffers from a real lack of enforcement. Data protection authorities are not taking enough action to enforce it, nor are they coordinated in how they deal with complaints across several borders.
6 About the organisations coordinating today’s action
The Civil Liberties Union for Europe (Liberties) is a non-governmental organization protecting and promoting the civil liberties of everyone in the European Union (EU). Headquartered in Berlin, with a presence in Brussels, Liberties is built on a network of national civil liberties NGOs from across Europe. Currently, we have member organizations in Belgium, Bulgaria, the Czech Republic, Croatia, Estonia, France, Hungary, Ireland, Italy, Lithuania, Poland, Romania, Spain, Slovenia, the Netherlands and associated partners in Germany and Sweden. Our aim is to ensure the full implementation of human rights in the EU.
6.2 Open Rights GROUP
Founded in 2005, Open Rights Group (ORG) is a UK-based digital campaigning organisation working to protect people’s rights to privacy and free speech online. Digital technology has transformed the way people live and opened up limitless new ways to communicate, connect, share and learn across the world. But for all the benefits, technological developments have created new threats to human rights. Open Rights Group exists to raise awareness of these threats and challenge them through public campaigns, media commentary, legal actions, policy interventions and tech projects.
6.3 PANOPTYKON FOUNDATION
The Panoptykon Foundation was established in April 2009 upon the initiative of a group of engaged lawyers, to express their opposition to surveillance. Its aim is to protect freedom and human rights in a surveillance society. It addresses the challenges posed by growing surveillance by monitoring & research, advocacy and education.
7 About The organisations FILING complaints today
7.1 Asociatia pentru Tehnologie si Internet (ApTi), Romania
ApTI is a Romanian digital rights organisation whose aim is to support and promote a free and open Internet where human rights are guaranteed and protected. A free Internet represents an environment where privacy and freedom of expression are both respected, while an open Internet represents a guarantee for a secure and rightful access to the benefits brought by information technology.
Bogdan Manolea, Executive Director, email@example.com
7.2 D3 – Defesa dos Direitos Digitais, Portugal
D3 – Defesa dos Direitos Digitais is a Portuguese non-profit association dedicated to the defence of fundamental rights in the digital context. Founded in 2017, it has been specialy active on issues such as copyright reform, data retention, net neutrality, vídeo surveillance, electronic voting and platform regulation.
Contact: Eduardo Santos, President, firstname.lastname@example.org
7.3 GONG, Croatia
GONG is a civil society organization focused on enhancing democratic processes and institutions as well as developing democratic political culture and encouraging active and responsible participation of citizens in political processes, particularly in decision-making processes related to the good governance of public and collective property, protection and promotion of the rule of law, human rights, and solidarity.
Melisa Skender, Associate Expert, email@example.com
7.4 Global Human Dignity Foundation, Malta
Global Human Dignity Foundation is a recently established Malta based NGO that works with and supports marginalized or oppressed communities, groups, and individuals to understand and exercise their rights. Our NGO addresses fundamental barriers to the full exercise of human and civil rights through education and advocacy.
Gabor Daroczi, Executive Director, firstname.lastname@example.org
7.5 Homo Digitalis, Greece
Homo Digitalis is the only digital rights civil society organization in Greece. Our goal is the protection of human rights and freedoms in the digital age. We strive to influence legislators & policy makers on a national level, and to raise awareness amongst the people of Greece regarding digital rights issues. Moreover, when digital rights are jeopardized by public or private actors, we carry out investigations, conduct studies and proceed to legal actions.
Eleftherios Chelioudakis, Secretary BoD, email@example.com
Elpida Vamvaka, President BoD, firstname.lastname@example.org
7.6 Institute of Information Cyprus, Cyprus
101.cy is a Cyprus-based community of research and practice on emergent phenomena in digital culture and rights, information freedom and control, and in network geopolitics with a focus on European, Middle Eastern, and African perspectives.
Marios Isaakidis, Co-founder, email@example.com