Challenges for the online advertising sector: new European legal developments

Legal developments affecting the online advertising sector are landing thick and fast in Europe at the moment, with further big changes on the horizon. 

Recent months have seen Google facing a class action lawsuit in the UK over alleged online behavioural advertising practices, and Hungary issuing new legislation governing rebate and commission arrangements between publishers and advertising intermediaries. However the biggest changes could be just around the corner, courtesy of the Data Protection Regulation. This new data privacy legislation is yet to be finalized but is expected to be hammered out over the coming months. 

UK class action against Google

The UK legal system doesn’t as a rule allow for opt-out representative class actions of the kind that are seen in the USA. However it is open to a claimant and his/her representatives to advertise for similarly affected individuals and club together to bring action collectively on an opt-in basis. That’s exactly what is happening following an initial UK Court of Appeal ruling in Vidal-Hall and others v Google, Inc. In a case initially brought by a handful of UK Apple users, relating to alleged unlawful cookie-based behavioural targeting, the court ruled amongst other things that:

• The individuals could bring proceedings in the English courts against Google, Inc. rather than any Google UK subsidiary.
• It was clearly arguable that “browser-generated information” such as IP addresses and cookie data should be seen as “personal data” under EU Data Protection legislation.
• Damages are available for distress caused by a data protection law breach even if no financial loss has been suffered.

This last point was a bolt from the blue and has sent shock-waves through the privacy and online advertising communities. The UK’s key data protection statute explicitly states that, with some limited exceptions, damages are only available for distress in circumstances where the individual has additionally suffered pecuniary loss. However, the Court of Appeal ruled that this provision is incompatible with European law and must be disregarded – which in turn has got litigation funders interested in the prospect of a substantial group claim against Google on behalf of multiple UK Apple users (see www.googleactiongroup.com). In one fell swoop, the court has significantly turned up the risk dial for the online advertising community.

Hungary’s “Loi Sapin“?

In separate news, Hungary has recently passed transparency legislation a little like France’s Loi Sapin. This new legislation (published as Act LXXII of 2015 on Establishing the Central Budget of Hungary for Year 2016 in the official gazette of Hungary on 18 June 2015) came into force in early July. Under the “Bonus Act”:

• advertising intermediaries are prohibited from accepting any direct or indirect bonus, rebate, gift or other gain from the media owner or any other person;
• advertising intermediaries may agree to a discount; however, it must be passed on to the advertising customer and indicated as such on the invoice issued to the customer;
• media agency agreements must be in writing and must include certain mandatory provisions. 

This adds another element of complication to an already complex analysis in Europe for those wishing to operate incentive or rebate arrangements for advertising intermediaries.

Data Protection Regulation 

The new draft Regulation has now entered the phase of “trilogue negotiations” between officials from the European Parliament, the European Commission and the Council of Ministers. The talks are timetabled to target finalized legislation by the end of the year. Much is at stake, including:

• The extent to which “online identifiers” such as cookies and IP addresses should be regarded as “personal data” – in all circumstances, or just if they can be linked back to an individual?
• The nature of consent required when consent is the ground for processing – “explicit consent” or just consent?
• Whether online advertising businesses can process personal data based on their legitimate interests (subject to certain provisos and caveats) even in the absence of consent from the data subject. The Council text specifically states that processing for direct marketing purposes “may be regarded as carried out for a legitimate interest“, which suggests that processing for online ad targeting and segmentation should be treated similarly. The Parliament text by contrast focuses only on B2B marketing and postal direct marketing.

We’ll be keeping a close eye on developments and will report further soon.