“The ad tech sector was and will continue to be a focus for the Irish Data Protection Commissioner due to concerns regarding profiling, particularly using sensitive data, the use of location data, and lack of lawful bases for or individual awareness of processing.”

Additional key takeaways from the IAPP white paper on the first year of GDPR include:

“The UK Information Commissioner’s Office cited fairness as an overriding theme in its investigations and enforcement actions, noting inquiries into unfair processing and lack of transparency. In terms of priorities moving forward, the Commissioner said the ICO is looking at data brokers, the processing of children’s data, and ad tech.”

Per Giles Watkins, IAPP UK country leader: “There is only a limited time for organizations to put their houses in order before the commissioner does revert to the enhanced penalty regime, with potential enforcement actions perhaps being even more significant to businesses than the monetary fines.”

Per Paul Jordan, Managing Director of IAPP Europe, we should: “Expect enhanced frequency of activity in 2019.. both at the member state level and through the EDPB. Any grace period afforded organizations..is truly at an end.”

Read the full report.