Ireland: Data Protection Commission launches inquiry into Google’s processing of personal data
Ireland’s Data Protection Commission (DPC) has opened a statutory inquiry into Google Ireland’s processing of personal data.
The inquiry will establish whether the processing of personal data as part of Google’s personalised online advertising system is compatible with the EU General Data Protection Regulation (GDPR).
The watchdog made the decision following a number of submissions, including those of Dr Johnny Ryan, chief policy and industrial relations officer at Brave.
A group of complainants including Dr Ryan and privacy experts in the UK, represented by Ravi Naik of London-based ITN Solicitors, claim that the auction-based system underpinning personalised online advertising sales broadcasts personal data to “tens or hundreds of companies” in the form of a “bid request”.
The group have also made submissions to the Information Commissioner’s Office (ICO) in the UK.
Commenting on the DPC’s decision, Dr Ryan said: “The Irish Data Protection Commission’s action signals that now – nearly one year after the GDPR was introduced – a change is coming that goes beyond just Google. We need to reform online advertising to protect privacy, and to protect advertisers and publishers from legal risk under the GDPR.”
Mr Naik, partner at ITN Solicitors, added: “For too long, the AdTech industry has operated without due regard for the protection of consumer data. We are pleased that the Data Protection Commissioner has taken action. The industry must change.”
In a statement, Google said: “We will engage fully with the DPC’s investigation and welcome the opportunity for further clarification of Europe’s data protection rules for real-time bidding. Authorized buyers using our systems are subject to stringent policies and standards.”