Out-Law News 2 min. read

Pseudonymous data should be free to process without consent, says advertising industry body

EU businesses stand to lose out if planned reforms to data protection laws are implemented as currently drafted, an advertising industry body has said.

The Internet Advertising Bureau (IAB) Europe said that online business-to-business (B2B) sellers in the EU will struggle more than consumer-facing organisations to obtain individuals' "explicit" consent to the processing of their personal data.

It said that businesses should be allowed to process pseudonymous data without having to gain consent to do so.

“Europe’s online B2B sector primarily uses anonymous or pseudonymous consumer data," Kimon Zorbas, IAB Europe's vice president, said in a statement. "Even Germany’s strict privacy framework allows for such processing."

"The IAB Europe fully supports the need to protect users but common sense should prevail. If online advertising is to support high-quality content creators, we need a more balanced approach that allows the use of pseudonymous data," Zorbas added.

In January the European Commission published plans to create a new General Data Protection Regulation, citing a need to update the fragmented data protection regime that it said currently exists across the EU.

Under the proposals, organisations engaging in direct marketing activities within the EU would have to obtain explicit, freely given, specific and informed consent from individuals in order to be able to lawfully process their personal data. Consent would not be able to be gleaned through silence or inactivity on the part of individuals and instead must be obtained through a statement or "clear affirmative action" before it can be said to have been given.

Direct marketing firms would have to provide consumers with the "right to object free of charge to the processing of their personal data for such marketing". The right to object would have to be "explicitly offered ... in an intelligible manner" and be "clearly distinguishable from other information".

Online businesses often record users' online behaviour in order to serve personalised content. The businesses often use 'cookies', which are small text files that detail users' web activity, to store that information. The website operators often sell on this information to advertising networks which serve targeted ads to internet users. The networks serve the behavioural ads by gleaning from the stored information what they deem the internet users to be interested in.

However, the IAB Europe said that B2B firms will struggle to meet the proposed standard for gaining consent.

"Concerns are running high in the European online media, research and advertising industry over proposed changes to the European data protection laws, which they say will result in new and wide ranging burdens for European online businesses," the IAB Europe said in its statement. "Contrary to global players that are strong B2C platforms, European players are mostly B2B companies. As such, they have no opportunity to obtain a user’s explicit consent easily. Thus European companies will be impacted much more than non-European companies."

Alain Heureux, president and chief executive of the IAB Europe, added: "If the Commission's proposal is enacted as it stands, both European businesses and users alike would suffer: business would be driven to non-European platforms and users might have less choice as a result."

Nick Stringer, director of regulatory affairs at the Internet Advertising Bureau in the UK, told Out-Law.com that data protection laws should not be drafted in a way that could stifle innovation.

"We believe totally in strong data protection law, however, it needs to be balanced with the fact that advertising is helping to fund the content users want," Stringer said.

Members of the IAB Europe met with representatives from the European Commission to discuss their concerns with the proposed data protection reforms last week.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.