The hunt for data is omnipresent in the digital advertising universe - but what happens when data protection falls by the wayside? An investigation by the Berlin data protection supervisory authority in 2024 raises precisely this question. The target of the inspection was a data-driven advertising company that obtains personal information via third parties and uses it for targeted online campaigns.
In particular, the authority scrutinised the consents on which the company relies for data processing. However, it quickly became clear that the consent processes were anything but transparent. Wording was difficult to understand, purposes were vague and it was not always possible to prove that users had consented at all. Particularly problematic: the consents were not obtained by the company itself, but by partners - often without sufficient control.
n addition, random samples revealed considerable inconsistencies in the data records. A single person was sometimes assigned contradictory characteristics such as different age groups. Such inaccuracies not only call into question the reliability of the advertising display, but also the legality of the underlying data processing.
A widespread misconception: if you have no direct user relationships, you're in the clear. However, the audit made it clear that service providers who receive data via third parties must also ensure compliance with the GDPR. This includes, in particular, proof of voluntary, informed and documented consent.
The Berlin data protection supervisory authority plans to forward the violations identified to the relevant authorities. However, even without immediate sanctions, the case provides valuable impetus for practice. For example, companies should carefully check their service providers and data sources in order to recognise potential weaknesses at an early stage. It is equally important to inform users clearly and comprehensibly about the purposes of data use and their rights. Consent must be documented in a comprehensible manner at all times. It is also important to strictly limit the use of personal data to what is necessary. Finally, companies should also regularly scrutinise the quality and consistency of the data records obtained from third parties in order to avoid misinterpretations or breaches of the law.
Source: https://www.datenschutz-notizen.de