This document discusses the legality of real-time bidding (RTB) under GDPR and who bears the risk of non-compliance. It notes that RTB involves broadcasting personal data internationally to various entities without ensuring proper deletion or purpose limitations. This violates GDPR principles. While the IAB claims its transparency and consent framework addresses this, investigations found ongoing issues. The document argues RTB likely violates GDPR and publishers may ultimately be responsible as data controllers, though determining clear liability is difficult given interlocking obligations of many involved parties. Education is needed on privacy risks to help achieve compliance.

1. IAB'S TCF, FROM STANDARD (?) TO
UNLAWFUL PROCESSING: WHO ENDS
UP WITH NON-COMPLIANCE RISKS?
Founder, Aurélie Pols & Associates
February 1st 2022
aurelie.pols@protonmail.com
1

2. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Data Governance & Privacy Engineer
Data is the New infrastructure – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• DPO for mParticle (Customer Data platform) – contractor (USA, New York)
• Founder – Aurélie Pols & Associates
• Expert Advisory Board (EAB) member - Panelfit (EU H2020 No 788039)
• Group expert member for the Observatory on the Online Platform Economy (E03607) – EU Commission
•Guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay Business School
Brussels (B)
• Board Member European Center On Privacy and Security, Maastricht University (NL)
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital ethics
• Former Vice-chair P7002 – Data Privacy Process – IEEE
• Speaker/writer/consiglieri: Mobile World Congress, SWSX, Strata (+ Hadoop World), IAPP, Piwik, AT Internet,
industry associations, AdTech & MarTech vendors, …
2003:
OX2 Co-founder
Webanalytics.be
2008:
Sold to Digitas LBi
(Publicis)
2

3. What I do for a living
In case you’re wondering ;-)
3

4. Interlocking liabilities & obligations
People
Company
(Telco,
Bank,
Insurance..)
Company
(Agency,
consultancy,
vendor, ...)
Cloud
provider
• Aligning contract obligations
• (+ enforcement?)
• Providing
• Security
• Privacy features
• Privacy engineering
B2C
B2B
B2B
Privacy
policies
Consent
MSA
SOW
T&C
4

5. IAB’s TCF on RTB
A little bit of history
5

6. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
There’s this guy in Ireland who talks of RTB
6
Video here:
https://vimeo.com/670735163

7. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
He has been tackling this subject
First as a publisher, then working for a browser and now at an NGO
7
Link https://iabeurope.eu/transparency-consent-framework/

8. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
The problem?
8
https://www.dataprotectionauthority.be/citizen/belgian-dpa-sends-its-draft-decision-in-the-iab-europe-case-to-european-counterparts

9. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
The “privacy freedom fighter” angle
9
Link
https://www.iccl.ie/digital-
data/apd-iab-findings/

10. 10

11. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Independent audit?
11
Link
https://iabeurope.
eu/blog/iab-
europe-launches-
new-tcf-vendor-
compliance-
programme/

12. 12

13. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
IAB side
13
Link
https://iabeurop
e.eu/blog/vendo
r-compliance-in-
the-tcf-what-it-
is-and-what-it-
isnt/

14. Taking a step back
From the playground
14

15. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
It started with denial
1. Advertising IDs are not PII, right?
2. Let’s ignore the concept of purpose limitation
3. The only lawful basis that exist is consent
Ø US notion of notice & choice
4. Keeping the data for ever is not an issue
5. Fairness is an impossible concept to respect
Ø Let’s ignore the also US notion of discrimination (eg. FCRA)
6. Sprinkle on top some security if really, really needed
15

16. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Yet the law is closing in
2 main reasons according to Johnny Ryan, for those who understand
how RTB works:
1. The biggest data breach in history
2. Enfrindging the purpose limitation principle ← NEW!!!
16

17. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
More specifically
17
Is there a week
without any
notice of
Google
enfringement?

18. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Translating this into GDPR lingo
Back to basics:
1. Personal data is broader than PII, personally identifiable
information
2. For data to be lawfully processed, a legal basis is required
1. This works per purpose ie data flow
2. Someone should tell Apple it’s not device only (ATT)
3. Data subjects have Rights
4. International data transfers are subject to conditions
18

19. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Words matter so much
19
Personal data - GDPR
Personal information - CCPA
Personally Indentifiable Information – ???
Sensitive Data – US COPPA, HIPAA, Infosec teams
Special categories of Data – GDPR
Financial data

20. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Problems of legality with RTB
The initial issues with RTB are:
An international broadcast of personal data to a variety of legal entities
1. If the auction is lost,
1. Are these legal entities deleting personal data?
2. Are these legal entities using those IDs for something else? (purpose limitation)
2. If the auction is won,
1. the personal data is passed onto other entities to fulfil the processing
operations of
1. Delivering the ad to the chosen profile on the chosen medium (Ad network + publisher)
2. Delivering the reporting around the advertising operation
20

21. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Looking at it from the data subjects’ side
2 main questions arise from the data suject side:
1. Notice: how is the user notified of all the legal entities that receive
her personal data? And for which purpose?
2. Rights: if the user wanted to exercise her rights to access, deletion,
rectification, objection, portability and non-profiling, how would
that work?
Both obligations lie with the data controller ie the publisher
21

22. Who is responsible?
Where does the risk lie?
22

23. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
This happened last week
Munich State Court finds use of Google Fonts in violation of GDPR and
grants compensation of 100€
Legitimate interest didn't apply. The website operator could have
integrated the fonts directly into their website, thereby avoiding
sending IP addresses to Google.
Small sum and yet, this is about actual compensation!
"The defendant is ordered to pay the plaintiff € 100.00 plus interest
thereon in the amount of 5 percentage points above the base rate since
28.01.2021."
https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/
23

24. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Another example
Spotify to support portability
24

25. Privacy fighting for
engineering resources
But who asks for what?
Where does the risk lie?
Education is essential
25

26. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Who gains?
26

27. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
The worst job today?
27
Link
https://iabeurope.eu/blog/wa
nt-to-join-the-iab-europe-
team-new-position-available-
privacy-counsel/

28. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Conclusion
• Is RTB legal? Probably not
• Who takes on the risk?
• Not the IAB
• Not the vendors
• The publishers maybe?
• Who wants to punish the publishers?
• ….
• Question everything!
• As Chris said, there are different angles. Always! Find the (risk) balance
28

29. Thank you for listening
Aurelie.pols@protonmail.com
29