< Back

Share |

Don’t shoot the digital advertising messenger! - Online behavioural advertising and the draft data protection Regulation

March 2013

The OFCOM 2012 Communications Market Report makes for interesting reading.  According to the report, UK internet users spent an average of 23.5 hours online per month in the previous year and commercial spend on internet advertising exceeded that from any other advertising channel.

An important driver of this rapid growth in the use of the internet has been the free availability to users of commercial content which is typically funded by online advertising. This model is essentially no different to that used to finance the free newspapers or magazines we collect on our way to the station at the start and end of the day. Unlike the physical paper however, the internet content will typically collect data of users to deliver advertising that is relevant to their interests.  This data may not reveal the real-world identity of the user but may mean that they can be virtually recognised as the same person by way, for example, of a unique cookie reference or a static IP address.


This data-reliant advertising model will be affected by the significant changes proposed to European data protection law by the draft Data Protection Regulation (Regulation).  In some cases these changes seek to ease the administrative burdens of compliance and will broadly be welcomed by many businesses, particularly those doing business across different EU countries. In other cases, the Regulation introduces a number of important new concepts and rights that could have a detrimental impact on this data-reliant model and the growth of the online advertising market.

When data becomes personal

A key issue relevant to online advertising is the wider definition of data subject and personal data at Article 4 of the Regulation. It is proposed that this will apply to a person who can be identified directly or indirectly by reference to a range of listed factors and which include, among other things, identification numbers and online identifiers.

An alternative amendment to this article of the Regulation has been presented by the European Parliament lead rapporteur, MEP Albrecht. This proposes introducing the concept of pseudonymous data. This would be a unique identifier which, although it does not permit the identification of a person, allows the singling-out of a data subject. This proposed amendment would remove any doubt as to whether online advertising, involving tools such as cookies or IP data, falls within scope of the Regulation. 

Explicit consent

Despite these changes, the proposals do not distinguish rules for the processing of data about clearly identifiable individuals from those who can be singled-out in a crowd but not identified. This is despite the likely reduced risks of processing non-identifiable data. Some of the rules will therefore prove difficult, if not impractical, for online advertisers to comply with.  How, for example, will an online advertiser verify that a person seeking access to personal data is the data subject of a non-identifiable profile that it holds? The UK Information Commissioner makes clear in his recent detailed analysis of the Regulation that any wider definition of personal data, including pseudonymous data, would also require the rules of data protection to be applied realistically.


Article 7 of the Regulation provides for a stricter definition of consent.  While browser/device based automated means to exercise choices regarding online data collection may emerge with time, at present a requirement to collect explicit user consent to the collection of online data is likely to be a logistically complicated task for online advertising companies. This could lead to cumbersome consent processes, impair the user online experience and risk triggering a decline in user participation.

Enhanced right not to be profiled

The Regulation also provides at Article 20, a right for a person not to be the subject of automated processing intended to evaluate certain aspects relating to them or to analyse or predict, in particular, certain factors about them including their personal preferences or behaviour.   The proposal in the Regulation includes a restriction on the scope of this right to those circumstances where the processing produces legal effects concerning this person or significantly affects them. 

It is not entirely clear from this Article whether it will apply to profiling in the context of online behavioural advertising.  In particular, it is debateable whether such behavioural processing would produce a legal effect or have a significant affect on a person. The potential scope of this right to behavioural advertising needs to be clarified.

laptopIt is worth noting that further amendments to this Article proposed by the European Parliament's lead rapporteur MEP Albrecht would, if adopted, replace this proposed rule with a complete prohibition on profiling. It is proposed that the exceptions to this prohibition would only be where the processing had the consent of the data subject or took place under a statutory provision. Such a proposal, if adopted, would clearly present particular challenges for online behavioural advertisers.

Other proposals

There are a number of other proposals in the Regulation that will have general significance for the online advertising industry, including difficulties in applying the new right to be forgotten to non-identifiable profile data and for the new obligations to conduct data protection impact assessments where proposed processing operations include data processed for profiling. In practice, these obligations are likely to impact equally on the wider range of data controllers and processors and may not present the same critical challenges for online advertisers as the proposals identified above.

Looking aheadeye

The industry has been active in putting forward views and lobbying on issues of concern with the Regulation. This process is likely to continue right up to the point the European Parliament and the Council of Europe each consolidate (and then ultimately agree) their views on the final form of the text of the Regulation. While it remains possible that agreement could be reached on these terms by June this year, it appears likely that this will not be the case. In the meantime, the provisions of the Regulation remain open to further negotiation and amendment.

If you have any questions on this article or would like to propose a subject to be addressed by the Global Data Hub please contact us.

Sally Annereau

Sally Annereau      

Sally discusses the draft data protection Regulation and the new challenges in the context of online behavioural advertising.

"There are a number of proposals in the Regulation that will have general significance for the online advertising industry, including difficulties in applying the new right to be forgotten to non-identifiable profile data."