LONDON: One of the challenges that marketers face in GDPR is the lack of guidance, but this could leave another trap open. Ad tech vendors have reportedly used a very broad definition of the key legitimate interest clause for data processing that could lead to problems along the way.

This is according to a report from Digiday, which found that many ad tech platforms are all too reliant on legitimate interest as confusion around enforcement continues.

According to some sources, location-based vendors are most at risk, as these face particular difficulties in gaining consent from users.

The Information Commissioner’s Office says of the clause: “It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.”

However, the office warns that interests must be balanced. “If they would not reasonably expect the processing, or if it would cause unjustified harm, their interests are likely to override your legitimate interests.” Organisations must detail any legitimate interests in their privacy notice.  

Crucially, for the clause to come into force, data processing must be necessary; if other methods are available then the rule will not apply.

“If a [location] ad tech vendor tells you they can use legitimate interest and they can’t explain why, they’re morons and don’t understand at all what GDPR means,” one ad tech executive told Digiday anonymously. The executive added that many location vendors reliant on bid-stream data are claiming the clause without having grounds to do so.

“They’re [agencies] getting high-level claims of legitimate interest but no real meat on the bones,” they said. “It will likely result in agencies culling [location] vendors.”

Part of the reason many vendors are grasping for legitimate interest is precisely the lack of guidance or detail about how the new regulation will be enforced. For many, this lack of clarity has left them retreating to a wait-and-see attitude.

Though various comprehensive guides are available to guide marketers, the words ‘may’ and ‘might’ are rife. However, one sure element is the need for clarity for the user in detailing processing interests.

Sourced from Digiday, ICO, Econsultancy; additional content by WARC staff