Powered by RTL Group | October 2018
GDPR: a Tale of Two Stories

Since the General Data Protection Regulation (GDPR) entered into force on 25 May 2018, much has been said about its negative impact on digital advertising. Let’s take a look at how our media industry is coping with the GDPR and turning a regulatory burden into an opportunity to take a more consumer-centric approach to data-driven online advertising.

How it all started

The GDPR was adopted in April 2016 after 4 years of preparation and thousands of amendments. The aim of EU legislators was to “harmonise” data privacy laws across Europe, providing greater data protection and rights for European citizens. The severe data breaches that became public scandals in the months leading up to the GDPR implementation further underlined the need for a change in legislation. Some months have passed since the GDPR was implemented in the EU. It is time to take a step back and assess its impact on our media industry to date.

A regulatory chaos

The GDPR replaced the old Data Protection Directive, dating back to 1995. The goal was to ensure a full and consistent adoption of data protection rules by all 28 EU Member States. Unfortunately, the complexity of the text and its associated guidelines has opened the door to a host of interpretations by EU institutions and national authorities, resulting in a regulatory chaos. One particular source of confusion for our media industry is the inconsistent application of the so-called “legitimate interest” as a legal base to process personal data for targeted advertising. Legitimate interest is a valid legal base for data collection and having this in the regulation protects European ad-supported publishers and the pluralistic media ecosystem they foster. However, some EU data protection authorities have challenged the lawfulness of this legitimate interest in the specific case of targeted advertising and made clear they would require consent for such a purpose. Another issue is the definition of “consent” under GDPR. In a world in which more and more advertising is sold, within milliseconds, on programmatic platforms, it is almost impossible to match the various requirements of valid consent. How do we ensure consent is “specific” and at the same time “informed”, when virtually hundreds of companies in the ad-tech value chain might be considered as controllers and therefore need to be individually named at the time consent is obtained? How do we make sure consent can be demonstrated along the advertising value chain while fostering data minimisation?

A drag on the EU digital single market vision

Such regulatory uncertainty resulted in major US websites going dark in Europe as they scrambled to comply with the GDPR, and US small businesses (including tech start-ups, video game makers and ad-tech businesses) pulling out of the EU rather than risk a very costly compliance breach. Many small European businesses also decided to shut down their websites given the complexity and cost of implementing the GDPR. It also resulted in Google taking a strict consent-based approach, cutting 25 to 40 per cent of online ad market demand overnight. So much for “bringing down barriers to unlock online opportunities”, the official motto of the European Commission’s Digital Single Market strategy… More importantly, the difficult debates in the first months of 2018 regarding the applicability of legitimate interest pushed a lot of publishers towards a consent-based approach, at the very last minute. The result? A consent click-through marathon for confused European citizens dealing with all shapes and forms of consent management interfaces as they were trying to access their favourite online content. Transparency alone doesn’t result in trust: only 17 per cent of German citizens believe their data is now better protected than it was before.

Embracing the uncertainty

The GDPR is here to stay and our industry is still getting to grips with its short-term revenue impact and more uncertain mid-term consequences. Meanwhile, the Council of the EU is struggling to reach a joint position on the proposed ePrivacy Regulation (ePR). As it is currently drafted, the ePR overlaps with the GDPR and will likely only cause more disarray and confusion. It will also likely further increase the concentration of aggregated user data in the hands of a few global digital platforms who have built data ecosystems allowing them to easily obtain consent in exchange for access to their services. In this context, we have no choice but to buckle up and embrace the uncertainty, focusing on the original intents of these regulations: the protection of data and privacy rights of EU citizens and the sustainable growth of European online businesses. Re-establishing trust in the data-value exchange between consumers, publishers and advertisers is critical for the digital advertising ecosystem to thrive in the years to come. With 69 per cent of European online users saying they would allow their browser data to be accessed in exchange for a free experience over paying for content, we believe there is a bright future for the online ad-supported economy. Indeed, that same survey revealed that European online users are more interested in being informed about the use of data than preventing it from being accessed – but information notices and opt-out settings must be easy to find and understandable. As an industry, we must collaborate across the advertising value chain to create simple and secure solutions that support the growth of the online ad-supported economy while complying with data protection and transparency requirements. With initiatives like the netID Foundation in Germany, we are at the forefront of a more consumer-friendly approach to data protection and consent management. As the local competitive environment is changing and digital giants are dominating the online advertising market, it is time for economic regulators to re-assess competition rules. It should be facilitated for media companies to engage in joint initiatives at local and European level – otherwise, competition with US platforms remains impossible as local EU media companies cannot re-create the so-called “network effect” that fuels the mechanics of the platform economy. We are convinced that with the appropriate regulatory framework, local collaborations will foster a diverse and vibrant media and entertainment ecosystem for the benefit of European consumers.

1June 2018 European netID Foundation survey of 1,081 German adult respondents aged between 16 and 59; 22017 study from research firm GfK on behalf of IAB Europe that surveyed 11,020 people across 11 European countries, including the U.K., France, Germany and Spain; 3An open industry standard initiated by Mediengruppe RTL Deutschland, Pro Sieben Sat.1 and United Internet, with which every website in Europe can offer its users a secure login pursuant to data protection regulations.

Discover the TV Key Facts publication here