UK Regulator Recognizes IAB Tech Lab Mechanism for Processing Data-Deletion Requests
The U.K. Information Commissioner's Office's (ICO) endorsement of a mechanism that processes requests for deleting personal data across the advertising supply chain "is an important moment for accountability and interoperability," Interactive Advertising Bureau (IAB) Tech Lab CEO Anthony Katsur said Tuesday in a press release.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The lab created the data deletion request framework (DDRF) to standardize sending deletion requests. It lets companies communicate consumers' data-deletion requests across their internal systems and external supply chain partners.
Earlier this summer, the lab worked with the ICO to demonstrate how the DDRF supports data-protection compliance. In July, the ICO updated its online tracking strategy, which includes plans to "investigate compliance failures in the wider adtech system."
ICO said it wants to ensure that people can "easily withdraw their consent from all organisations with which their personal information has been shared within the adtech ecosystem." The DDRF could improve how third-party entities handle deletion and withdrawal requests that facilitate the delivery of digital ads, the ICO said, adding it "encourages its implementation."
Building on the ICO endorsement, the lab said, it plans to release DDRF updates with further technical refinements for public review this summer. The lab is a non-profit consortium that develops technology and standards with the goal of encouraging growth and trust in the digital media ecosystem.
An unrelated IAB Europe standard, the transparency and consent framework (TCF), ran into problems with the Belgian Market Court in May (see 2506010001). The TCF is a mechanism for managing users' preferences for online personalized advertising that plays a key role in Real Time Bidding (RTB), a system that enables personalized ads.
The court found that while IAB Europe is responsible for building the framework and the way it works, it's not responsible for misuse of the system by individual advertisers and intermediaries.
The DDRF is different, an IAB Tech Lab spokesman emailed us. Unlike consents, data deletion requests are individual, except in California, where the California Delete Act will establish a central deletion platform that isn't yet available, he said.
When a consumer initiates a deletion request, it often must be propagated to downstream parties beyond the website where the request originated, the spokesman noted. "This is where the DDRF comes into play, enabling that propagation."