Google Adtech: Irish Data Protection Authority for inaction in court

Real-time trading of personal data via Google Adtech is probably illegal in Europe. But the competent authority has been wriggling for years. Now she is being sued.

The Supreme Court of Ireland has upheld a lawsuit against the State Data Protection Commission DPC. The authority investigates only tentatively against Google and the connected companies because of possible violations of the GDPR. 

Specifically, it is about a complaint by the civil rights organization Irish Council for Civil Liberties (ICCL) from 2018, which had reported massive security breaches in the real-time trading of personal data. 

The DPC paid only a lack of attention to Google's data trading systems to the tracking-based advertising industry and, when viewed later, omitted the most important aspect – that of security. The plaintiffs speak of the "biggest data breach of all time," reports Techcrunch.

Real-Time Bidding: User Data in the Auction

With modern adtech real-time bidding (RTB), advertisers bid digital advertising spaces in real time. This happens automatically in the approximately 2.6 seconds loading time of a website. The profiles of the users who access the site are becoming increasingly important. Companies use cookies to track users and create profiles. The more they know about the user, the more they pay for the ad impression. For years, the procedure has been suspected of violating the GDPR.

Insider fights data breach by Google

Johnny Ryan is a senior icCL executive and a former adtech insider. Since 2018, the whistleblower has been trying to get the relevant authorities to turn to the "massive data breaches" he accuses Google and the system of. He regularly publishes studies and dossiers. In September 2020, he proved that the online advertising industry makes intimate characteristics of Internet users without their knowledge and consent. At the time, he also reprimanded the Data Protection Authority for its continued inaction.

Ireland's competence in the European Union

Since Google, like many other tech companies, has its European headquarters in Ireland, the Irish DPC is responsible for compliance with the data protection regulations. Ryan has already lodged a complaint with the European Commission because the decentralized review does not work in the case of Ireland. In 2019, the DPC finally launched an investigation into Google's adtech, but it committed itself to its own approach, which of all things excluded the security factor.

The core of Ryan's complaint, however, was that the system is based on sending highly sensitive data about people (surfing habits, device IDs, locations, etc.) across the Internet to a large number of middlemen without the tracked data subjects having any influence on it, and that this is a blatant security breach. Ryan emphasizes that this is greater than all the violations ever recorded and that the failure of the authority now affects all Europeans.

Belgium takes action against RTB actors

While Ryan has been waiting for four years for Google and the advertising platform IAB to be scrutinized by the DPC, the Belgian data protection authority has reacted. The IAB's Transparency and Consent Framework uses pop-up windows to ask users to allow data for ad targeting. The authority found that it violates the GDPR several times. It is said that the IAB has received a very long list of violations – with a request to address them. They should contribute so profoundly and systemically to RTB operation that experts doubt that the IAB can eradicate them without shaking up the entire system.

The inglorious history of the DPC

This is not the first or second time that the Irish Data Protection Authority has been counted. Again and again, their cumbersome approach to enforcing the GDPR is striking. For example, the EU Commission massively revised fines issued by the DPC upwards. In the case of violations by Twitter, Whatsapp and Facebook, the authority was accused of having decided too mildly. Also in the case of Facebook, a lawsuit of the ICCL against the DPC attaches.

The Austrian data protector Schrems is also suing. He accuses the DPC of silencing data protection actors via confidentiality agreements. Ryan had also received one. In the present case, the court could force the DPC to investigate the security of Google's adtech.