Russmedia (C\u2011492\/23)<\/a>, where the
\nCourt made a number of findings clarifying the roles and
\nresponsibilities of advertisers and publishers that process
\npersonal data contained within ads. In particular, the CJEU found
\nthat:<\/p>\n
\nPersonal data will fall within the scope of Article 9(1) of the
\nEU GDPR (i.e. special category personal data) where it indirectly
\nreveals protected characteristics, such as information about an
\nindividual’s sex life or sexual orientation. It is immaterial
\nthat the information in question is untrue [paras. 52 and
\n53].
\n
\nA website operator (publisher) processes personal data when it
\npublishes an ad containing personal data \u2013 the act of loading
\npersonal data onto a webpage constitutes ‘processing’ for
\nthe purposes of the EU GDPR [para. 54]. Although the case
\nconcerned an online marketplace, this reasoning is capable of
\napplying equally to more traditional publishers.
\n
\nThe publisher is a controller in respect of that processing. It
\nis immaterial that the ad was created by an “anonymous
\nuser advertiser,” or that the publisher had any actual
\ninfluence over the content of the ad or awareness of its untrue and
\nharmful nature [paras. 54 and 55]. While the advertiser
\nprincipally determines the purposes and means of the processing
\n(and therefore is a controller), the publisher is also a controller
\nbecause it exerts influence over the processing for its own
\npurpose. In particular, it publishes the personal data
\n“for commercial or advertising purposes which go beyond
\nthe mere provision of a service which he or she provides to the
\nuser advertiser” [paras 66 and 67]. Further, by
\nmaking its online marketplace available, the publisher participates
\nin determining the means of publication [para. 70] and sets
\nthe parameters for the dissemination of ads [para. 72].
\n
\nThe publisher and the advertiser “must be considered joint
\ncontrollers” when the ad is published, as they jointly
\ndetermine the purposes and means of processing within the meaning
\nof Article 26 of the EU GDPR [para 92].
\n
\nControllers are required to implement appropriate technical and
\norganisational measures (TOMs) to ensure, and to be able to
\ndemonstrate, that processing is performed in accordance with the EU
\nGDPR (Article 24), and to ensure the effective implementation of
\ndata protection principles that meet the requirements of the EU
\nGDPR and protect the rights of data subjects through privacy by
\ndesign and by default (Article 25) [para 94].
\n
\nThe publication of personal data on an online marketplace (and,
\nby extension, an ad containing personal data on any website)
\nentails significant risks for individuals, as that data becomes
\naccessible to any internet user and may be copied and reproduced
\nelsewhere. Those risks are heightened where special category data
\nis involved [paras. 95 and 96].
\n
\nWhere the publisher “knows or ought to know”
\nthat ads containing sensitive data are liable to be published, it
\nis obliged to implement TOMs to identify such ads before
\npublication and to be in a position to assess whether the sensitive
\ndata is being published in accordance with the principles of the
\nGDPR (including lawfulness, fairness and transparency) [para.
\n97].
\n
\nBecause the data in question is special category data, the
\npublisher must also ensure that the data subject has given their
\nexplicit consent to the publication, or that another Article 9
\ncondition applies [para. 98]. In addition, the publisher
\nmust ensure that its identity and contact details are provided to
\nthe data subject [para. 100].
\n
\nWhere special category data is contained in an ad, the
\npublisher must implement TOMs to ensure an appropriate level of
\nsecurity, including measures aimed at preventing loss of control
\nover the data. To that end, the Court indicated that publishers
\nshould consider technical measures capable of blocking the copying
\nand reproduction of online content [paras. 121, 122 and
\n126].
<\/p>\n
Although the facts of this case involved an anonymous user
\nadvertiser acting in bad faith, and the website concerned was an
\nonline marketplace rather than a traditional media outlet, the
\nCourt’s findings are likely to have broader implications for
\npublishers and the advertisers whose ads appear on publishers’
\nwebsites.<\/p>\n
The Court’s clarification of party roles is helpful. It is
\nnot uncommon for advertisers to characterise publishers and other
\nsupply chain participants as mere processors of personal data
\ncontained within ads. However, this judgment reinforces that
\npublishers may themselves be controllers, and joint controllers, in
\nmany circumstances. This raises practical questions about how
\nadvertisers and publishers can comply with the requirement to put
\nin place a transparent Article 26 joint controller arrangement,
\nparticularly given the complexity of the advertising ecosystem and
\nthe number of intermediaries that may sit between them.<\/p>\n
That said, it remains unclear whether many of the Court’s
\nfindings should be confined to situations in which the publisher
\nknows or ought to know that ads containing sensitive data are
\nliable to be published. In traditional media, many publishers (and
\nthe vendors that represent them) operate policies prohibiting ads
\nthat are likely to reveal sensitive data about identifiable
\nindividuals. If you are a publisher or vendor, now may be a good
\ntime to revisit those policies.<\/p>\n
More generally, questions remain about the compliance burden in
\nrelation to ads that contain only ‘ordinary’ personal data.
\nArguably, publishers must still take steps to ensure compliance
\nwith the GDPR principles, but what those steps look like in
\npractice is far from clear.<\/p>\n
Finally, it remains to be seen how these issues would be
\napproached by the UK Information Commissioner’s Office (ICO) or
\nthe UK courts. The ICO has previously demonstrated a willingness to
\ntake a more relaxed approach than the CJEU when assessing whether
\ninferences about individuals amount to special category data, and
\nit will be interesting to see whether a similar approach is adopted
\nin this context.<\/p>\n
The content of this article is intended to provide a general
\nguide to the subject matter. Specialist advice should be sought
\nabout your specific circumstances.<\/p>\n","protected":false},"excerpt":{"rendered":"Bryony Long\u2019s articles from Lewis Silkin are most popular:
within Privacy topic(s)
with Inhouse Counsel
in United…\n","protected":false},"author":2,"featured_media":15222,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":["post-332105","post","type-post","status-publish","format-standard","has-post-thumbnail","category-united-kingdom","tag-gb","tag-great-britain","tag-greatbritain","tag-news","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/332105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=332105"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/332105\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/15222"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=332105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=332105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=332105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}