Culture, Media and Sport CommitteeFurther written evidence submitted by the Advertising Association
During your visit to advertising agencies in Soho last week, when we were at Spotify, industry concerns about the EU’s proposed Data Protection Regulation were raised. You asked me to provide you with a short brief, which is enclosed.
While we understand the need to update the law to take account of digital technology, the European Commission’s proposals could significantly burden UK businesses, stifle innovation and hinder growth in the advertising sector. The proposals would severely impact the operation of the internet and on the UK’s fast-growing digital economy, which is the market leader in Europe. It is estimated that the UK market will represent 30% of European e-commerce in 2012.
The MOJ’s impact assessment cites a recent study by Booz&co which found that privacy regulations requiring opt-in before any data is collected would reduce investors’ interest in advertising technology companies by 65%. The Internet Advertising Bureau estimates that the EU proposals may cost the UK an estimated £633 million in lost advertising revenues as companies reduce their advertising expenditure. There would clearly be severe consequences for the creative economy, fledgling digital business models, and advertising revenues that support delivery of online creative content.
We have had excellent engagement with the new Justice Minister, Helen Grant MP, and with Culture Minister Ed Vaizey MP, and we are hopeful that the British Government’s negotiations in Brussels can improve the proposed Regulation. However, the UK has a real challenge in negotiations with other Member States, and in the European Parliament, where the lead MEP on this issue strongly supports the direction being taken by the European Commission.
This is a crucial issue for the UK advertising industry and it would be very helpful if the Committee could highlight the industry’s concerns as part of its current inquiry.
Advertising Association’s Position on the European Commission’s Data Protection Proposals
The Advertising Association
The Advertising Association (AA) is the only organisation that represents all sides of the advertising and promotion industry in the UK—advertisers, agencies and the media. In the UK, the advertising industry employs more than 250,000 people. In 2011, advertising expenditure was £16.1 billion.
Overview
Online advertising spend will reach £5.3 billion in 2012. This money acts as a source of funding for online content and services. Consumers value the free access this allows them—for instance, lAB data shows that only 10% of internet users would pay to remove ads from the websites they currently use for free. Much of online advertising’s value stems from use of data, which allows advertisers to show ads that are interesting to web users. Such emerging methods in turn reduce barriers to market entry for business and content providers of all sizes, allowing for the greatest mixture of content and services to be made available.
Because of the progress in digital technology, we believe that updating the law on data protection is sensible. However, we do not think the proposed EU-wide Regulation in its current form is an effective way to do so. The current proposals do not strike a fair balance between the rights of the individual to ensure that their personal data is protected, the needs of businesses to engage with consumers, and the potential damage to online content and service providers.
We are seriously concerned about the content of the draft Data Protection Regulation which we believe could significantly burden businesses and hinder growth in the advertising sector. We reject the European Commission’s premise that it will lead to a net saving for companies estimated at €2.3 billion and call on the Commission to provide a clearer evidence base that shows where these savings may come from. We believe that the Regulation as proposed could seriously stifle innovation and increase costs. We are confident in our belief that implementing the proposals in their current form may well outweigh the alleged potential savings to businesses.
The Advertising Association believes that the European data protection legislative framework should remain high level, with the Commission focussing on inconsistencies of application and enforcement across the EU. The Commission’s attempts to legislate for the current digital age are likely to be out of date in five years’ time and we would encourage the Commission to focus on a principles-based legal regime that can evolve as technologies develop.
Analysis of the impact of the Regulation
The definition of personal data (eg including some IP addresses & cookies as personal data) and consequences for profiling—In general, IP addresses and cookies are anonymous data and this new Regulation would unnecessarily personalise these data sets with severe consequences for responsible and useful profiling. The use of cookies and IP addresses is essential to the smooth running of the internet. It is also necessary for the delivery of targeted advertising that is relevant to a browser but that uses no personally identifiable data. The personalisation of these data sets and the introduction of a stricter consent requirement (see below) could corrode the Viability of entire business models, particularly online advertising intermediaries.
Further, the impact on the consumer of having what is currently “anonymous” data, like cookie data, considered “personal” could undermine the way in which genuinely personal data is processed as businesses are forced to treat these data sets equally. It is also concerning that the Regulation appears to hollow out the concept of special or sensitive categories of personal data.
The requirement for explicit and informed consent for data collection & processing—The inclusion of the word “explicit” would most likely lead to requirements for increased “opt-in” mechanisms for the collection of what are effectively anonymous data sets (eg cookies and IP addresses). Businesses will essentially be forced to personalise these data sets in order to obtain the explicit consent of users. This is both hugely burdensome for business and would severely undermine the consumer’s online and offline experiences. From a practical point of view, it would lead to multiple pop-ups online for cookies and severely affect the direct marketing industry with the likely impact being an increase in unaddressed mail. Taking the cookies issue specifically, industry is working hard to comply with the consent requirements set out in the ePrivacy Directive, and so amending the consent requirements in this Regulation would further increase burdens on already highly pressured businesses.
The introduction of a “right to be forgotten”—The advertising industry, and particularly the direct marketing sector, is especially concerned about the proposed right to be forgotten, and specifically its impact on third party data list brokers. The Regulation would require companies that hold an individual’s data and pass them to third parties to not only have to delete their information, but also to ensure the third party deletes this information too. This is extremely burdensome for businesses. The current data protection laws already set out rules that provide people with information on the identity of the organisation processing their personal data, and the purposes of this. Articles 12 and 14 of the current Directive provide a right of access and a right of objection. Individuals can require their personal data to be erased, blocked, changed or deleted. There is certainly a need to provide greater information to people about these rights and for the industry to wherever possible enable people to exercise these rights. However, the introduction of the blunt instrument of a “right to be forgotten” is not a positive step forward and likely to be unfeasible given the impracticalities that would arise in reality.
The bureaucratic and financial burden on businesses (especially SMEs who make up a large part of our sector) due to extra staff and possible sanctions—The advertising industry would be severely impacted by the bureaucracy and sanctions that are required in the Regulation. These burdens include: hiring a Data Protection Officer, addressing the fact that they could be liable to a fine of 2% of their annual turnover, and processing the increased amount of data now classified as “personal”. The Commission speaks of €2.3 billion savings for business. We do not know where the Commission obtained that number from and industry certainly disputes the idea that money will be saved—rather it will impose a lot of costs.
The extension of powers to the Commission through “delegated” and “implementing acts”—The Commission has included many of these acts which enables it to toughen the Regulation without any proper industry consultation or check and balance of an orderly legislative process. This will lead to increased business uncertainty about the future shape of data protection law in Europe. Furthermore, the lack of proper consultation with industry and other EU institutions is extremely worrying and will continue to deepen the problematic issues around the democratic accountability of the Commission.
December 2012