What lies ahead for adtech?

2023 has started with big fines. Ireland’s DPA decision to fine Meta €390 million says that “contractual necessity” as the lawful basis for behavioural advertising is not appropriate. However, commentators have observed that this is not the end of adtech, as consent is available as a legal basis for serving behavioural ads. Another issue altogether is the interplay between Ireland’s DPA and the European Data Protection Board (EDPB) which intervened to change some details in the decision as well as the level of the fine.

More adtech news comes from Belgium where the DPA has approved IAB Europe’s updated Transparency and Consent Framework. Other big tech companies have also been told to be more transparent and several high-level fines have followed. Professor Graham Greenleaf analyses the state of play regarding enforcement globally, and the level of fines issued so far, and comes to the conclusion that the EU is the only region in which countries regularly impose fines of €5 million or more.

The European Commission launched a process last December to adopt a new EU-US adequacy decision, and we hope to see results by this summer. This is very welcome news for companies that have had to face uncertainty caused by the Court of Justice of the European Union’s Schrems II decision. An alternative way for transfers, although costly, is using Binding Corporate Rules as prescribed in the EU GDPR. The UK ICO has its own process, which is not identical to the EU’s, but broadly similar. PL&B’s workshop in cooperation with law firm Hogan Lovells identified the differences and proposed solutions to the EDPB on 10 January.

As we were going to print, the EU and the US signed an administrative arrangement to bring together experts from across the US and Europe to further research Artificial Intelligence (AI), computing, and related privacy protecting technologies(1). This is exciting news considering the forthcoming EU AI Act and plans for a US Algorithmic Accountability Act.

In AI, global regulatory convergence would be the ideal and the EU is aiming for leadership, as with the GDPR. AI will be the topic for several sessions, and will for sure generate interesting discussions at Who’s Watching Me?, our 36th International Conference in Cambridge 3-5 July.

Laura Linkomies
Editor, Privacy Laws & Business

February 2023