EC, Privacy Groups Tentatively OK Self-Regulatory Approach But Want More Detail

The BPR incorporates principles from the Interactive Advertising Bureau Europe’s online behavioral advertising framework, an explanatory document says. Together, the regime establishes new standards for openness and user control and will “radically change” the way consumers are informed and empowered to make meaningful choices about online targeting, it said.

The proposal recognizes that website visitors are likely to expect that the sites will use their data to customize their experience, the document said. However, users won’t necessarily expect that third-party companies will also collect Web-viewing data from them, it said. The system will introduce a “visible enhanced notice” for third-party advertisements, including an icon that will be uniform across Europe, it said.

When clicked on, the icon will provide more information about the businesses involved in providing the particular advertisement in simple layman’s language, and give consumers easy access to a control tool that gives them information about OBA and the possibility to opt-out, the summary said. Those who opt out will still get advertisements, but not those tailored to their potential interests based on previous surfing, it said.

Websites that have OBA companies on their sites will have to give users clear notice in their privacy statements about OBA and include a link to the consumer control tool, the summary said. The framework and BPR also make clear that if a business uses technologies that are intended to collect all or substantially all URLs visited on a PC or any other device, and uses the data for OBA, it needs express consent from the consumer. The regime bans the specific targeting of children, and requires users’ explicit consent for use of sensitive personal data as defined by EU data protection law.

The system also introduces new compliance measurement and enforcement procedures, the summary said. Compliant companies will receive a renewable “seal” which will be taken away if they fail to correct significant breaches of their obligations, it said. The failure will be communicated to the public and the market as well, it said. Signatories must choose compliance program providers with expertise in online measurements and/or auditing. In addition, businesses in the EASA network of self-regulatory organizations must cooperate closely with each other and with any other entities responsible for handling consumer complaints, it said. This will ensure consistency, openness and coherence across the EU and European Economic Area, it said.

The roundtable showed that industry has “some clear political support” from the EC for its approach, said European Publishers Council Executive Director Angela Mills Wade, one of the plan’s authors. EASA members “left with some clear goals for the next stage,” she told us.

There was some criticism, however, Mills Wade said. Some participants complained about “one-sided” messages on the program’s landing page which talks about the benefits to consumers of OBA but says nothing about how and what data is collected, how it’s used and how long it’s kept, she said. There was also griping about language used on the webpage as well as the choice of words for the link next to the icon, which some believed didn’t really describe OBA or prompt consumers to click, she said. EASA members made it clear they are open to constructive suggestions for improvement, she said.

One particularly “animated discussion” centered on the proposal for an opt-out approach to OBA, said data protection lawyer Paolo Balboni, executive director of the European Privacy Association. The EU Article 29 Data Protection Working Party, whose members are national privacy chiefs, stressed the importance of an opt-in approach, a stance some roundtable participants believe clashed with the EASA scheme, he said in an interview. But EASA and the EC said it remains to be seen if there’s a conflict, and that the key goal is to ensure consumers are fully informed about OBA and have user-friendly tools to deal with it, he said.

The EPA believes self-regulation is a “good way to go,” Balboni said. But this is still a work in progress with several issues to be resolved, he said. One is that while the icon is supposed to appear on any “European site” that uses OBA, the definition of such a site isn’t completely clear and the information provided not entirely transparent and user-friendly, he said. The EPA also wants more information on who will issue the compliance seals and how the scheme will be enforced, he said. The proposal is “a snapshot of a good idea” but needs to be fleshed out, he said.

The EC seems to have made up its mind to accept the industry proposal but with several reservations, said independent privacy consultant Cédric Laurant. It wants more input from the consumer protection and privacy sectors, and more data about how aware users are of online tracking and how likely they are to click on the icon, he said. Many consumer representatives at the roundtable said the icon looks like part of an advertisement, making it difficult for users to distinguish, he said.

The EC urged participants to send EASA comments on the draft proposals and advise the Information Society directorate of any plans they have to boost education on and awareness of OBA. The next roundtable is tentatively set for March 8.