Everyday newspapers and television programs highlight how people's lives are more and more exposed to the web. The issue of monetization of personal data is drawing more and more public attention. The massive use of information technologies and the social media today allows big tech companies to collect considerable amounts of data, to be used for different purposes. Data collection initially was just a by-product of the use of online services; now, collected data represents the real product, to be sold to other clients (mainly, other companies).

Online services are offered for free as long as it is possible to profit from the use of the data that is collected. The most relevant way to get profit is advertising; collected data enables companies to construct very accurate profiles of users, which is vital to properly target advertising campaigns (if you wish to have further details, see this analysis by Dentons’ Chantal Bernier “Personalising marketing and services - how far can you go under privacy law?”). It is not surprising that certain companies achieved great success through their power to select customers on the basis of their preferences for certain products. They target potential customers among those who show most interest in buying the product on offer and, in so doing, they increase the chance that the product will be sold; on the other hand, no time and money is wasted in showing the product to those less keen to buy.

In order to clarify the identity of the stakeholders involved in the marketing campaigns and the data flows taking place behind the scenes, the EDPB issued its Guidelines 8/2020 on the targeting of social media users (“Guidelines”), in public consultation until October 19, 2020.

We decided to go through the Guidelines with the help of our consultant Luca Brighenti - entrepreneur, CEO and founder of B4Bind - asking ourselves a few key questions on the implications of online advertising as regards users' data protection.

A. Why has the EDPB issued its Guidelines on such a specific matter?

Online advertising presents a number of complex legal issues. It is certainly not new to the experts that it implies a massive use of personal data; however, the legal framework on this matter has not been adequately updated. The GDPR is a recent piece of legislation that needs to be read together with the ePrivacy Directive, as regards the use of cookies and similar technologies (still the most common tools to run online advertising campaigns). The Directive dates back to 2002: since then, the types of trackers and technologies through which users are targeted have developed greatly.

In this respect, Luca Brighenti reminds us “data has become integral to society as we all become connected and tracking the consumer’s online/offline activity increasingly gained importance. Publishers and advertisers use users’ data collected via mobile apps, website cookies, and third-party data providers to identify and target customers and prospects everywhere. After years of operating with minimal oversight or concern for user privacy, where marketers funneled billions of euros into platforms using sketchy third-party data, cookies and reckless privacy practices, the advertising industry is finally beginning to adopt a privacy-first approach (e.g. privacy regulations, the blocking of third-party cookies and the recent switch by Apple to opt-in for accessing IDFAs), which it hopes will gain back the trust of frustrated consumers. Surely, privacy regulations and industry updates have impacted the way in which brands are collecting and using customer data but now the ad industry must take a step back and refocus the attention on the end consumer and the appropriate use of personal data by marketers in developing and placing advertising”. See also our previous article “Cookies and online advertising: an ongoing changing scenario”, which examines this matter further. Given this scenario, companies have to comply with privacy and ePrivacy legislation in the absence of clear and uncontroversial explanations from the relevant Authorities

The EU Court of Justice recently issued a number of judgments of the utmost importance in order to clarify online marketing relationships and stakeholders's responsibilities (inter alia, the so-called Wirtschaftsakademie and Fashion ID decisions). These decisions may open a Pandora’s box, as companies may be (partially) liable for the unauthorized processing of users’ data. The EDPB provides its view on how the chain of stakeholders is designed.

B. Who are the stakeholders involved in the targeting of users according to the EDPB?

The stakeholders are mainly the social media providers (i.e. those offering online services that enable the development of networks and communities of users), where their user-generated data provides opportunities for companies to understand individuals to an unprecedented degree. Targeters, on the other hand, are the natural or legal persons that make use of social media services in order to direct specific messages on the basis of specific criteria. The massive amounts of user information and the availability of up-to-date data make social media platforms an attractive target for those seeking to collect and aggregate this information, either for legitimate purposes (improving the quality of personalized services, etc.) or reprehensible goals. Targeters and social media providers exchange data in many ways; in order to target users, they may employ banners, feeds, timelines and stories in many ways. Here privacy issues, such as “identity disclosure”, could be prominent. Targeters’ pages and applications may integrate social media’s APIs or SDKs. APIs in particular, are an obvious weak spot for cyberattacks focused on intercepting data, so it is fundamental for every organization to bolster data protection efforts. In the Guidelines the EDPB identifies the roles of the stakeholders depending on the data source: social media providers and targeters are usually identified as (joint) controllers.

C. According to a strict interpretation of the data protection legal framework, social media do not always share personal data with targeters. Why then are they considered (joint) controllers?

Lack of access to personal data does not prevent processing from taking place (as a consequence, data protection legislation still applies). This is the key element of the so-called Wirtschaftsakademie decision. The Guidelines re-affirm this principle by highlighting that “indeed, joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned. The EDPB recalls that actual access to personal data is not a prerequisite for joint responsibility”.

D. One of the most challenging activities is to identify the applicable legal basis.

Yes. Certain processing activities are clearly linked to the service provision, while other purposes are located in a grey area. In such cases, controllers are required to perform a balancing test when they wish to rely on their legitimate interest in the processing of users’ data. To perform a balancing test, commonly referred as LIA (legitimate interest assessment), the controller is required to have a full understanding of how the processing takes place. The EDPB provides a useful indication under note 54, and lists the key aspects to be taken into account when assessing the impact in the context of a targeting directed at social media users: inter alia, the purpose of the targeting, the level of detail of the targeting criteria, the combination of targeting criteria. Further processing can be performed with the users’ previous consent.

E. Is there any specific indication regarding soft spam?

The EDPB seems to provide an interesting indication sub note 59. The EDPB notes that “in the situation where the advertisement […] would be directly sent via a push notification or a direct message to the data subject, Article 13 of the ePrivacy Directive would be applicable. However, in this specific example, consent would not be required, insofar as Article 13(2) states that the electronic contact details of an existing customer may be used by an entity for “direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner”. Such indication is a bit unclear: it seems, however, that the EDPB extends the application of the soft spam exception to means other than e-mail. This seems to be also supported by the recent versions of the ePrivacy Regulation draft; according to art. 16, the soft spam seems to be accepted when marketing communications are sent through the use of “contact details for electronic message”, assumed that other requirements occur (by way of example, that the contact details are collected in the context of the purchase of a product or service).

F. Why is it important to understand data flows in the context of advertising campaigns?

Luca Brighenti reminds us that “sophisticated marketing and advertising platforms have given us [marketers] the power to gather data points about customers that take the guesswork out of digital advertising. Today we live in a data-driven advertising world, where everything is measurable and traceable, and companies have literally dozens of ways to use data for online advertising. Brands across the globe are leveraging search data, browsing and buying behavior, historical data like past purchase history, engagement trends, location data, social media data and more in order to deliver personalized online advertising. Furthermore, the users’ data collected online helps marketers to predict future patterns, which, in turn, translates into more optimal marketing strategies.Understandably, although advertising need a sufficient level of information about consumers in order to be effective, internet users have shown concern about the tactics used by marketing companies that provide customized ads. Therefore, despite recent advances in data privacy legislation and practice, consumer’s privacy is regularly invaded or compromised by companies and governments”.

The EDPB expounds its concerns at the very beginning of the Guidelines: certain operators may use personal users’ data to a larger extent then they expect, without providing sufficient information to the users themselves, sometimes even contributing to discrimination and exclusion. It is of the utmost importance to ensure transparency and to provide users with the possibility to consciously decide how their data can be processed. The debate is still open and certain regulations are being questioned: considering the evolving technology scenario, consent may not always be the best way to protect users, which may not be fully capable to understand certain complex data processing.

Do you have more questions, or do you want to share your thoughts on this article? Contact our Dentons Italy TMT Team at tmtbites.italy@dentons.com, and do not forget to sign up to our TMT Bites Newsletter!

This article has been co-authored by Giangiacomo Olivi (Giangiacomo.Olivi@dentons.com).