Interactive Advertising Bureau Europe

Brussels, 29 April 2020 For additional information, please contact Greg Mroczkowski, Director, Public Policy at IAB Europe ([email protected]) and Filip Sedefov, Director, Legal at IAB Europe ([email protected]). IAB Europe Rond-Point Robert Schumanplein 11 1040 Brussels Belgium iabeurope.eu IAB Europe’s input to the European Commission’s report on the application of the General Data Protection Regulation - Executive Summary This document contains an overview of IAB Europe’s input to the European Commission’s report on the application of the General Data Protection Regulation (GDPR). IAB Europe (Transparency Register: 43167137250-27) is the European-level association for the digital advertising and marketing ecosystem.

Register: 43167137250-27) is the European-level association for the digital advertising and marketing ecosystem. ● The GDPR adoption was a substantial milestone, establishing the principles of data protection for the foreseeable future, including, and indeed explicitly, in the digital advertising context. ● Compliance with its provisions require material time and resources from companies that do business in and with the European Union (EU). IAB Europe and its members invested considerable resources in developing the Transparency & Consent Framework (TCF), which increases transparency, choice and accountability in relation to how personal data is processed by different actors in the online media and advertising sectors. These legal compliance efforts, amongst others, inform our views on the application of the GDPR.

…advertising sectors. These legal compliance efforts, amongst others, inform our views on the application of the GDPR. ● We recommend further harmonisation of rules and interpretation of GDPR concepts. In particular, we observe: ○ diverging interpretations of the notion of “freely given” consent which should be clarified, in a manner that is proportionate and in line with intended outcomes under the GDPR; ○ equal status of the all GDPR legal bases for processing being put in question, and more specifically, the availability of legitimate interests as a ground for the lawful processing of data for advertising-related purposes; ○ insufficient understanding of the interplay with the ePrivacy instrument, and introduction of rules in the proposed ePrivacy Regulation that deviate from the principles adopted with the GDPR.

…and introduction of rules in the proposed ePrivacy Regulation that deviate from the principles adopted with the GDPR. ● We believe that harmonisation of rules and interpretation of GDPR concepts should contribute to and enable effective enforcement of the law. Against this background, we advise that: ○ industry legal compliance tools, such as the TCF, can be used as enablers of effective enforcement; ○ transnational Codes of Conduct have the potential to bring significant benefits to data controllers and legal certainty to data subjects, and we would like to insist on the fact that this approach to compliance be prioritised.

…certainty to data subjects, and we would like to insist on the fact that this approach to compliance be prioritised. ● We fully support the need to protect citizens’ fundamental right to privacy and data protection, but we are concerned that in the process one may be losing sight of other fundamental rights protected in the EU, such as the right of property and the freedom and pluralism of the media. The GDPR must not be interpreted in vacuum, especially since Europe’s content economy depends on digital advertising. Advertising accounts for over 81% of European newspaper and magazine digital revenues, and any decrease in these monetisation opportunities supporting the objective, good- quality journalism would have serious consequences for the social and political landscape in Europe. Ref.

…good- quality journalism would have serious consequences for the social and political landscape in Europe. Ref. Ares(2020)2298020 - 29/04/2020 2 IAB Europe Rond-Point Robert Schumanplein 11 1040 Brussels Belgium iabeurope.eu IAB Europe’s input to the European Commission’s report on the application of the General Data Protection Regulation IAB Europe (Transparency Register: 43167137250-27) represents 25 European national associations who in turn represent over 5,000 companies from across the digital advertising and marketing ecosystem, from advertisers and advertising agencies on the buy side, news publishers and other ad- funded sites and online services on the sell side, and technology providers facilitating the delivery of ads. We have over 90 companies in direct membership, including agencies, technology companies, publishers and eCommerce companies.

…over 90 companies in direct membership, including agencies, technology companies, publishers and eCommerce companies. The adoption of the General Data Protection Regulation1 (GDPR) was a substantial milestone, establishing the principles of data protection for the foreseeable future, including, and indeed explicitly, in the digital advertising context. Compliance with its provisions require material time and resources from companies that do business in and with the European Union (EU). IAB Europe and its members invested considerable resources in developing the Transparency & Consent Framework (TCF), which increases transparency, choice and accountability in relation to how personal data is processed by different actors in the online media and advertising sectors. These legal compliance efforts, amongst others, inform our views on the application of the GDPR.

…advertising sectors. These legal compliance efforts, amongst others, inform our views on the application of the GDPR. We are grateful for the opportunity to provide comments on the forthcoming European Commission’s (Commission) report on the application of the GDPR.

…to provide comments on the forthcoming European Commission’s (Commission) report on the application of the GDPR. This submission has been framed in the following way: • Preliminary remarks • Part 1 – Introduction – Background o Relevance of the GDPR for the digital advertising ecosystem o IAB Europe’s Transparency and Consent Framework • Part 2 – Harmonisation of rules and interpretation of GDPR concepts o Definition of the “consent” legal basis o Lawful bases for processing: legitimate interest o Interplay with the ePrivacy instrument • Part 3 – Effective enforcement of the law o Industry legal compliance tools as enablers of effective enforcement o GDPR Transnational Codes of Conduct (CoC) • Concluding remarks 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and…

…free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016. 3 IAB Europe Rond-Point Robert Schumanplein 11 1040 Brussels Belgium iabeurope.eu Preliminary remarks According to Art. 97 GDPR, the Commission shall submit a report on the evaluation and review of the GDPR to the European Parliament and the Council, due by 25 May 2020. IAB Europe welcomes the opportunity to provide feedback on the application of the GDPR, conveying the views of the digital advertising and marketing ecosystem, including based on learnings from the legal compliance efforts undertaken by the industry. These considerations extend beyond the scope of Art.97(2) GDPR, and as such we encourage the Commission not to limit the review to the topics specifically laid out in the aforementioned provisions.

…encourage the Commission not to limit the review to the topics specifically laid out in the aforementioned provisions. Our view in this matter reflects the Council’s position on the application of the GDPR, as adopted on 21 December 20192, as well as other EU policymakers3. We hope that following the public consultation period, the Commission will reflect some of our input in the final text of the report. We would be pleased to have the opportunity to discuss these observations with the Commission at an appropriate time. On that note, we would also like to observe that the scope for provision of feedback appears to be unjustifyingly limited, intimating scarce opportunities for the industry, and the broader society alike, to voice their views.

…limited, intimating scarce opportunities for the industry, and the broader society alike, to voice their views. IAB Europe’s application to join the GDPR Multi-Stakeholder Group had not been retained and the Group itself is very small, which is inadequate given the importance of the data protection legal framework. We would recommend the consultation approach be rectified in the future. Part 1 – Introduction – Background Relevance of the GDPR for the digital advertising ecosystem The adoption of the GDPR was a substantial milestone, establishing the principles of data protection for the foreseeable future, including, and indeed explicitly, in the digital advertising context. The scope of the law is comprehensive and guarantees the protection of personal data both in the context of electronic communication services and information society services.

59 → 12

originalus šaltinis (PDF) ↗