Notes

The Balancing Test

Article 6 (f) of the GDPR includes the following important caveat: “except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject”. In other words, a business that intends to use personal data must balance its legitimate interest not only against the rights of the data subject, which is a significant test in itself, but also the data subject’s interests, irrespective of whether these interests are legitimate or not. Any company that hopes to use legitimate interest also bears the onus for demonstrating that its interest is favored in such a balancing test.

Behavioral Advertising and Data-Brokering Must be Based on Consent

The legitimate interest provision in the GDPR sets a high bar. Indeed, the Working Party’s concern about the negative impacts of personal data misuse is so broad as to encompass those that result from many cumulative actions, and where “it may be difficult to identify which processing activity by which controller played a key role”.

Two Options

Therefore, hundreds of adtech companies, who cannot legitimately obtain the personal data they depend on, are facing a huge challenge. There are two categories of options.

Option 1. Invest heavily in obtaining consent
For the majority of advertising intermediaries this will require reaching an accommodation with publishers who have direct and trusted relationships with end-users.

Option 2. Avoid the GDPR’s liabilities and regulatory overhead with a no personally identifiable data approach
Programmatic and behavioral advertising are possible without personally identifiable data. A personal data firewall can free brands and intermediaries from the GDPR’s new liabilities and regulatory overhead by anonymizing data while delivering relevant advertising.