World Federation of Advertisers

WFA submission European Commission 2020 report on the application of the General Data Protection Regulation ( GDPR ) About WFA 1. The World Federation of Advertisers (WFA )is the voice of marketers worldwide, representing 90% of global marketing communications spend – over €800 billion per year – through a unique, global network of the world's biggest brands an d national advertiser associations . WFA champions responsible and effective marketing communications worldwide. 2. We represent over 100 global brands and 60 national advertiser associations worldwide. This includes national advertiser associations in 19 EU Member States, and around 50% of the companies we represent are European.

…national advertiser associations in 19 EU Member States, and around 50% of the companies we represent are European. 3. Our work with brands focuses on creating better interaction between brands and consumers in a digital world. This includes looking at ways to go beyond compliance to give consumers transparency, choice and control about how their data is used by brands in a marketing context. This is both a societal and economic issue for brands: consumers will only trust brands which use their data in a responsible way. Introduction

…and economic issue for brands: consumers will only trust brands which use their data in a responsible way. Introduction 4. WFA welcomes this opportunity to contribute to the Commission’s report on the application of the GDPR as required by Article 97 of the Regulation. We welcome the Commission’s intention to identify possible issues in the application of the GDPR by means of the report. Although Article 97(2) requires the report to examine, in particul ar, the application and functioning of Chapters V and VII , th is consultation offers an opportunity to ensure the Commission is aware of ot her relevant issues. Consultation on the roadmap is also important because it enables a wide range of stakeholders to contribute , including those which are not currently members of the GDPR Multi - Stakeholder Group.

…of stakeholders to contribute , including those which are not currently members of the GDPR Multi - Stakeholder Group. 5. WFA support s the GDPR’s approach of upholding principles designed to give consumers transparency, control and choice over how and when their data is shared. In particular, we support maintaining the GDPR’s risk -based approach which provides companies with sufficient f lexibility to process data based on likely impact on data subjects’ fundamental rights and freedoms. Experience with d ata p rotection a uthorities: g uidelines issued by EDP B and by national DPAs

…rights and freedoms. Experience with d ata p rotection a uthorities: g uidelines issued by EDP B and by national DPAs 6. The European Data Protection Board ( EDPB )has issued guidelines on several issues which have helped ensure consistency of approach across Member States. W e believe that it is essential for the proper functioning of the single market that the EDPB ensures, as far as possible, a consistent approach to GDPR enforcement across different national data protection authorities ( DPAs ) . We encourage the EDPB to promote and enable consistency across Member States in order to avoid fragmented approaches to divergent or even contradictory GDPR enforcement at n ational level.

States in order to avoid fragmented approaches to divergent or even contradictory GDPR enforcement at n ational level. 7. Since the GDPR entered into force, the public de bate and understanding of harmful online content, including disinformation, and the extent of online manipulation and fraud has advanced considerably. It is important that actions to counter these negative influences are not unduly limited based on various interpretations of the GDPR. We therefore call for DPA guidance and enforcement to ensure sufficient flexibility to enable the collection of independently audited measurement data which is n ecessary to: Ref. Ares(2020)2248564 - 27/04/2020 o Measure the effectiveness of advertising . This includes aggregated data used to enable advertisers to know how their ads are performing across different platforms (e.g. how many times it was viewed, for how long etc.) and web…

…volume, annoyance and improve relevance. Impact of Article 7(4) GDPR regarding the conditions for valid consent 8. We welcome clear and specific guidance from DPAs on how to communicate with consumers about their privacy choices and rights. However, w e encourage DPAs, where possible, to ensure that the recommendations in their guidance are based on real - world evidence of human behaviour , rather than only a legal assessment of the requirements of the Regulation . We believe that user testing is essential to help defin ehow, where and when consent should be gathered in order to create the best conditions for consu mers to have transparency, choice and control over their personal data. The EDPB should adopt EU -wide guidelines so that DPAs are required to harmonise and include user testing in their approach to developing guidance .

…guidelines so that DPAs are required to harmonise and include user testing in their approach to developing guidance . 9. DPA guidance on cookies is particula rly relevant to ensuring that data can be collected for the purposes listed in paragraph 7 above , because the guidance often clarifies the consent requirements for specific use cases e.g. analytics cookies. 10. We are concerned that some of th e guidance adopted by DPAs has been inconsistent across Member States , and that there is little specific guidance related to some of the use cases mentioned above , notably ad vertising fraud and effectiveness.

…specific guidance related to some of the use cases mentioned above , notably ad vertising fraud and effectiveness. Our analysis is set out in the table below and w e highlight in particular: • Differing guidance on whether consent is required for analytics cookies: no consent is required for analytics cookies under certain conditions in France and Germany, whereas it is required in Spain, Greece, Belgium, Denmark and I reland, but there are variations in the way consent may be given and the description of the exact circumstances in which it is required.

…are variations in the way consent may be given and the description of the exact circumstances in which it is required. • Limited and differing views on whether consent is required for cookies to prevent advertising fraud: in Germany, prevention of fraud can be recognised as a legitimate interest , although it is not clear whether this would exten d to advertising fraud specifically ; in Spain, consent is not required to prevent fraud related to security of a service, but there is no specific reference to advertising fraud . Other Member State DPAs which have issued guidance have not addressed th is specific issue .

…to advertising fraud . Other Member State DPAs which have issued guidance have not addressed th is specific issue . Table 1: Variations in DPA guidance on cookies and consent Member State Advertising measurement and effectiveness Ad vertising fraud prevention France Article 5 states that analytics trackers are exempt from consent requirements, subject to a number of conditions, such as that users should be informed and be given the opportunity to opt out, and that Not specifically addressed. the trackers in question must only produce anonymous statistics.It is not made clear whether the exemption for analytics would cover the collect ion of essential data needed to measure advertising effectiveness, such as frequency, viewability and engagement.

…of essential data needed to measure advertising effectiveness, such as frequency, viewability and engagement. Germany Page 13 states that consent is not required for analytics cookies unless they lead to a data transfer to a third party, in which case consent is still not required if the user is given the option to opt out. This exemption would not include the collection of essential data needed to measure advertising effectiveness, such as frequency, viewability and engagement. Page 11 states that the prevention of fraud qualifies as a l egitimate interest (as per GDPR R ecital 47) . However, there is no specific reference to advertising fraud. Spain Section 1 states that only cookies strictly necessary for the provision of a service are exempt from consent requirement s.

18 → 12

originalus šaltinis (PDF) ↗

…1 WFA submission European Commission 2024 Report on the Application of the General Data Protection Regulation (GDPR) About WFA The World Federation of Advertisers (WFA) is the voice of marketers worldwide, representing 90% of global marketing communications spend – roughly €900 billion per year – through a unique, global network of the world’s biggest markets and biggest marketers. WFA champions responsible and effective marketing communications worldwide. We represent over 146 brand owners and 60 national advertiser associations across the world. This includes national advertiser associations in 19 EU Member States and about 50% of the companies we represent are European.

…national advertiser associations in 19 EU Member States and about 50% of the companies we represent are European. Introduction WFA welcomes the opportunity to contribute to the Commission’s second report on the evaluation and review of the EU General Data Protection Regulation (GDPR), and openness signalled in the Commission’s Call for Evidence to contributions on all aspects of the application of the GDPR and the widest possible input from stakeholders. While not represented on the GDPR Multi-Stakeholder Group, WFA members have significant experience in navigating the application of the GDPR as it affects advertisers. WFA continues to support the GDPR’s approach of upholding principles which are designed to provide consumers with transparency, control and choice over how and when their data is shared.

…which are designed to provide consumers with transparency, control and choice over how and when their data is shared. We support maintaining the GDPR risk-based approach which was intended to provide organisations with sufficient flexibility to process personal data, always taking into account the likely impact on data subjects’ fundamental rights and freedoms. In this document, references to question numbers refer to the European Commission’s questionnaire to the GDPR Multi-Stakeholder Group, issued on 19 September 2023. Data Protection Authorities (DPAs) – Questions 4b and 4d As the number of cases considered by DPA, courts and tribunals has increased, so has the value of guidelines produced by the European Data Protection Board (EDPB) which summarise the current state of the law and the approach which has been agreed collectively by DPAs.

Board (EDPB) which summarise the current state of the law and the approach which has been agreed collectively by DPAs. EDPB guidelines have been important in helping ensuring consistency of approach, and they also help advertisers assess their obligations and DPAs’ likely view of various practices. A consistent approach to GDPR obligations and the avoidance of fragmentation are valuable to WFA and its members, who often operate in several member states. Common standards bring standardised operations, which benefit these companies. It is important that these standards are well-considered and withstand legal challenge.

…benefit these companies. It is important that these standards are well-considered and withstand legal challenge. The range of EDPB guidelines which have been finalised since the last review of GDPR shows that the EDPB has tackled several subjects where different interpretations of GDPR requirements had indeed been questioned and where it was important to consider harmonisation or closer approximation. We value the opportunities for stakeholder input into the EDPB guideline-making process. The current guideline-making process combines consideration between DPAs with public consultation. It allows for fair consideration in detail of a range of views on increasingly complex issues of implementation of GDPR and related legislation.

…in detail of a range of views on increasingly complex issues of implementation of GDPR and related legislation. The use of the EDPB consistency mechanism in some GDPR enforcement cases shows that there are still differences of opinion between member state DPAs on aspects of GDPR enforcement. It remains inevitable that some enforcement decisions taken by DPAs will be challenged in the courts (whether or not they result from the consistency mechanism), and some of these challenges will be pursued until these issues are considered by the Court of Justice of the EU. It is important that this right to challenge remains available.

…are considered by the Court of Justice of the EU. It is important that this right to challenge remains available. However, the debate about well-founded, harmonising guidelines based on consideration of a range of perspectives helps create an enforcement environment in which such legal challenges focus on interpretations which advance stakeholders’ and regulators’ understanding of harmonised GDPR enforcement. The EDPB Guidelines on the concepts of controller and processor in the GDPR (07/2020), on the targeting of social media users (08/2020) and on deceptive design patterns in social media platform interfaces (03/2021) are useful resources for WFA and its members. However, we believe that the examples in the Guidelines published could be more developed to consider various different scenarios and nuances. Ref.

…examples in the Guidelines published could be more developed to consider various different scenarios and nuances. Ref. Ares(2024)939687 - 07/02/2024 2 Clarity on use of cookies for attribution, combating advertising fraud and frequency capping In the submission we made before the Commission’s 2020 report on the application of GDPR, we highlighted the varying (and sometimes conflicting) opinions of DPAs on the regulatory requirements for cookies used to record attribution of digital advertising impressions, to combat advertising fraud and to prevent the same ad being shown repeatedly to the same user. We called for guidelines which would address the varying opinions and enable the collection of independently verified ad measurement data.

…which would address the varying opinions and enable the collection of independently verified ad measurement data. Since then, there has been further development of differing DPA views on the requirements for the placing of such cookies, with some DPAs accepting that such cookies can be set without the need for consent, while others take the view that consent is required. This has resulted in conflicting information. The public consultation on the EDPB’s draft Guidelines 02/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive has recently closed. Although the consultation is welcome, a number of stakeholders consider that the EDPB’s draft guidelines may lead to consent being required for ad attribution, and this may therefore lead to consent being required for the presentation of even contextual advertising.

…attribution, and this may therefore lead to consent being required for the presentation of even contextual advertising. More clarity on this would be helpful to drive legal certainty in this area. The Commission’s recent initiative to develop a “Cookie Pledge” and the 2023 study conducted for DG CNECT on the impact of recent developments in digital advertising on privacy, publishers and advertisers have led to interest in contextual advertising as an allegedly “less intrusive” form of digital advertising than behavioural advertising. The suggestion has been made that the “Cookie Pledge” principles might require the offer of a “less intrusive” form of advertising as an further alternative to consent to the use of personal data or payment of a fee in “Pay or OK” models.

…advertising as an further alternative to consent to the use of personal data or payment of a fee in “Pay or OK” models. Although the EDPB has issued its own opinion on the draft “Cookie Pledge” principles, we believe that the parallel development of EDPB guidelines on relevant parts of the ePrivacy Directive and a Commission-inspired voluntary scheme on the use of cookies has increased the scope for confusion about the application of EU legislation, rather than decreased it. The relevant EDPB guidelines and the “Cookie Pledge” should be compatible with one another, and both should take into account the explanations from relevant stakeholders about the operation of digital advertising in practice.

…take into account the explanations from relevant stakeholders about the operation of digital advertising in practice. Future EDPB guidelines about the interplay between new EU legislation and data protection rules WFA believes that it is important that the EDPB begin to develop guidance which explains the interplay of new EU digital legislation, including the Digital Services Act, Digital Markets Act and AI Act, with EU data protection legislation. In some cases, assertions and assumptions were made about the interplay when the legislation was under discussion, so it is important that guidance is developed quickly and in ways that allow stakeholders to provide input.

16 → 12

originalus šaltinis (PDF) ↗