Ireland's data watchdog slammed for letting adtech carry on 'biggest breach of all time'

A dossier of evidence detailing how the online ad targeting industry profiles Internet users’ intimate characteristics without their knowledge or consent has been published today by the Irish Council for Civil Liberties (ICCL), piling more pressure on the country’s data watchdog to take enforcement action over what complainants contend is the “biggest data breach of all time”.The publication follows a now two-year-old complaint lodged with Ireland’s Data Protection Commission (DPC) claiming unlawful exploitation of personal data via the programmatic advertising Real-Time Bidding (RTB) process — including dominant RTB systems devised by Google and the Internet Advertising Bureau (IAB).The Irish DPC opened an investigation into Google’s online Ad Exchange in May 2019, following a complaint filed by Dr Johnny Ryan (then at Brave, now a senior fellow at the ICCL) in September 2018 — but two years on that complaint, like so many major cross-border GDPR cases, remains unresolved.And, indeed, multiple RTB complaints have been filed with regulators across the EU but none have yet been resolved. (Whereas RTB broadcasts personal data across the Internet, leaking highly sensitive information in the process, per earlier evidence gathered by the complainants.)He told TechCrunch the regulator finally sent him a letter, in May 2020, in response to his request to know what the scope of the inquiry is — saying then that it is examining the following issues:We’ve asked the DPC to confirm whether its investigation of Google’s adtech is also examining compliance with GDPR Article 5(1)f and will update this report with any response.The DPC did not respond to our question about the timing for any draft decision on Ryan’s two-year-old complaint.