Advertisers

The EU General Data Protection Regulation (GDPR), which enters into force on 25 May 2018, will have impact on all organizations in EU member states that process personal data. This means changes and actions also for advertisers.

Take notice of the GDPR especially with respect to targeted online advertising

As a result of the GDPR, the concept of personal data is wider, as for example IP addresses and cookies are considered to be personal data. Consequently, targeting of advertising with the help of cookies and building of interest area profiles by using cookie techniques constitutes processing of personal data. Processing of personal data is not limited only to cookies but covers also data collected with other similar methods (for example fingerprinting).

Request consent for processing of personal data collected with cookies and disclose the use

Collecting of personal data for the purposes of targeting of advertising requires legitimate basis for processing. Placing cookies requires consent from the user in accordance with regulation that applies to cookies.  When collecting data, the user must be informed of the use of data collected. When collecting sensitive information or location data, an express consent from the user must be requested. Privacy information must describe the parties that will obtain collected personal data. Companies also have an obligation to document their processing of personal data in order to be able to demonstrate compliance with applicable rules.

Roles in processing of personal data

The roles in the context of processing personal data vary depending on the case:

Controller determines the processing of personal data and its purposes. The role of controller covers, among others, requesting of consent for the targeting of advertising and informing the user on the processing of personal data. Either Alma Media or the advertiser may act as the controller. 

Processor complies with controller’s instructions and agreements with the controller and processes data at the request and on behalf of the controller. The role of the processor covers, among others, processing of personal data in the planning, technical execution and measurement of an advertising campaign. If the processor utilizes the received data independently for its own uses, the processor then becomes controller. The law requires that this kind of change of role must be agreed in advance in writing, so that the actual controller is able to comply with its statutory obligations and to inform the user on the collecting of data and its purposes. In this kind of situation, the role may comprise of, among others; re-using of the data collected from advertising campaign or building or enriching of profiles based on the collected information. It should be noted that collecting data from Alma’s services and/or use of data for targeting of advertising outside Alma without prior written consent of Alma is prohibited.

As a responsible cooperation partner of advertisers, Alma Media has made the required amendments to its media sales terms and conditions, as a result of which the sales terms and conditions are updated to be compliant with the new data protection regulation. The amendments cover, among others, section 18 of the sales terms and conditions, where the provisions for processing of personal data are set out. The updated sales terms and conditions will enter into force on 15 May 2018. Get to know the new sales terms and conditions here.