Johnny Ryan: AdTech, GDPR, 3rd Party Cookies, Real-Time Bidding, Privacy Sandbox, Programmatic ads
00:01 Introduction
00:58 Why data breach is at the heart of online advertising
01:08 Mechanics of real-time bidding
03:05 Is third-party cookies mechanism unavoidable?
04:00 Advertising is and was always about standard setting (and there are only two main)
06:05 The rules already exist – but they are not enforced as they should
07:00 The most workable solution – no use of personal data
08:00 Online advertising business works today as Wild West
09:00 Is not it too late to design workable rules?
10:00 Is the Tech too complicated to be lawful?
10:30 Look at financial sector. Regulate the largest
11:40 Advertising exchanges – that is what should be regulated/monitored/enforced
12:30 If you are inside the system, the system works, and there are relatively easy ways to regulate it
13:30 Privacy sandbox and a cascade of challenges (and opportunities)
17:30 Privacy sandbox and horizontal new entries
20:00 Data protection enforcement will be a huge boost for competition (including new entrants)
22:00 "Internal" data-free-for-all is as illegal as the "External" data-free-for-all See Art 5 GDPR
26:20 The narrative that the is inherent conflict between data protection law and competition law is not true
26:40 If we get enforcement of purpose limitation, data minimisation, storage limitation – we would have much more vibrant markets – even in merger control
27:30 The rationale of purpose limitation
30:45 Enforceability of purpose limitation requirements
32:30 It looks like there is a big complicated knot of incomprehensible threads (with programmatic advertising and purpose limitation requirements) that we cannot cut through – but actually nobody has turned up with the scissors at all. This set of regulatory tools is laying completely unused
33:00 How the DMA team will be enforcing the rules... These companies already infringe many laws
34:40 Single regulator – or many regulators?
36:55 Although Irish data protection authority is not effective we shouldn't think that moving things to Brussels will sort all problems
37:00 Johnny Ryan to the Commission: "You have a duty not only to intervene when the European law is being infringed – you have a duty to know whether to intervene".
38:00 Implications of Johnny's message to the Commission: 6 times a year the Commission will obtain from every data protection authority across European information of all large scale cases
39:00 We have cases gathering dust for many years. The teacher is now inspecting the homework. At very least they don't want to look bad
40:00 Correspondence of the Commission with the Irish Minister for Justice and the Irish Data Protection Commissioner
41:00 Supplementing the GDPR
42:30 Why GDPR is a frustration term
43:50 Online advertising and media industry
44:20 So far pretty much everything happening with media industry was bad news – and the industry has almost lost hope
45:50 Advertising is an art – not the science
47:30 The hypocrisy of charts and data – we don't know how many people watched your ads. It is a hypocrisy
49:30 In offline world publishers are big players. In online world publishers are largely commoditised – they are even arbitraged
51:00 Hidden fees – and no one knows how much is hidden
53:30 Publishers are loosing competences to compete – they are getting used to it. They are constantly playing a game of how can we not get that power
53:55 Solution – data protection (detailed explanation of the proposed mechanism)
55:00 Can the media industry create an alternative online advertising machinery?
56:45 Third party cookies as a pathology – even if we bring some order here – wouldn't they be flourishing in other less privacy mindful jurisdictions? And then after training their digital muscles they will set the agenda in the EU? Is it a real concern?
59:00 We were talking about Brussels effect – but in fact we were not enforcing our own law, showing bad example to those who have followed us. We in some sense betrayed the privacy agenda
01:00:50 It is a fallacy to claim that more data necessarily means better trained AI
01:05:30 Recommendation for students: read the original papers, don't rely on second-hand sources, avoid commentaries until you get information from primary information; also try to explain things which you try to communicate visually (diagrams – and Johnny is really good in them)
In this detailed conversation one of the most impactful experts in surveillance, data rights and privacy Johnny Ryan explains his thesis that data breach is at the heart of online advertising, proposes the ways of addressing this issue, elaborates on the latest development in the field, discusses the mechanics and implications of digital advertising and suggests real solutions to the systemic problems in the area.
Dr Johnny Ryan, Senior Fellow, the Irish Council for Civil Liberties, Senior Fellow, the Open Markets Institute.