Google Faces Scrutiny In Ireland Over GDPR

• by Wendy Davis  @wendyndavis, May 22, 2019

Regulators in Ireland are investigating whether Google's real-time bidding platform violates Europe's privacy laws, officials said Wednesday.

“The purpose of the inquiry is to establish whether processing of personal data carried out at each stage of an advertising transaction is in compliance with the relevant provisions of the General Data Protection Regulation,” the Ireland Data Protection Commission stated. 

The GDPR, which went into effect May 25 of last year, sets out sweeping privacy mandates, including the requirement that companies obtain people's consent before using their data for ad targeting.

The Ireland DPC also plans to probe whether Google minimizes the data it collects and retains, and whether the company complies with transparency principles. 

The commission said Wednesday its investigation stems, in part, from filings by Johnny Ryan, chief policy officer for the Brave browser. Last September, Ryan alleged in complaints filed with European regulators that Google (and other online ad tech companies) engage in “pervasive and invasive profiling and processing of personal data for profit.”

Among other allegations, he said Google doesn't control what happens to data about consumers after it's shared with other companies via real-time bidding -- which means Google can't prevent third parties from using consumer data in ways that may violate the GDPR, or even tell consumers how their data will be used by third parties. 

A Google spokesperson said: “We will engage fully with the DPC’s investigation and welcome the opportunity for further clarification of Europe’s data protection rules for real-time bidding. Authorized buyers using our systems are subject to stringent policies and standards."

In January, Ryan supplemented the original complaint with new papers alleging that Google profiles web users based on sensitive data like “religious beliefs, ethnicities, diseases, disabilities, and sexual orientation.”

Google said at the time it doesn't create profiles based on sensitive data, or allow advertisers to target people based on categories including race, sexual orientation, health conditions and pregnancy status.

News of the investigation in Ireland comes four months after privacy regulators in France fined Google around $57 million for failing to obtain people's unambiguous consent before using their data to target ads.