GDPR and online advertising – Panoptykon consults IAB Poland’s code of conduct

We have taken part in the public consultations of the draft code of conduct which is supposed to help apply the GDPR to the internet advertising sector. The code was prepared by the Polish office of the Internet Advertising Bureau.

There are two fundamental issues that we were particularly critical about:

• the definition of personal data in the context of online advertising,
• the methods of obtaining  consent from users for the purpose of advertising (forced consent).

As to the definition of personal data, the code claims that online identifiers, such as cookie IDs, do not constitute personal data on their own. They only become personal data when the controller has access to extra information about the user, such as his or her name or e-mail. We strongly disagree with this interpretation. The authors of the code seem to have ignored the concept of singling out, introduced by the Article 29 Working Party over a decade ago. What’s more, recital 30 of the GDPR directly mentions that online identifiers can be used to create unique user profiles which lead to particular individuals.

We have also strongly criticised “forced consent”. The code suggests that merely closing the pop-up window or scrolling the website constitutes valid consent under the GDPR. In our view these actions or not clear or affirmative, and therefore do not meet the conditions laid down by the regulation.

Full text of our opinion and of the draft code is available in Polish on our website.

Karolina Iwańska