Data protection watchdog launches statutory inquiry into Google's Ad Exchange

The Data Protection Commission (DPC) has begun a statutory inquiry into the processing of personal data by Google Ireland's Ad Exchange business.

It is the first such investigation of this kind launched by the data watchdog into the internet giant.

In a statement, the commission said the probe had arisen from its ongoing examination of data protection compliance in the area of personalised online advertising.

It also said it had received a number of submissions on the subject from external parties, including Dr Johnny Ryan from Brave, the makers of an open source web browser and ad blocker.

Brave argued that when a person visits a website, intimate personal data that describes them and what they are doing online is broadcast to tens or hundreds of companies without their knowledge in order to auction and place targeted adverts.

"The purpose of the inquiry is to establish whether processing of personal data carried out at each stage of an advertising transaction is in compliance with the relevant provisions of the General Data Protection Regulation (GDPR), including the lawful basis for processing, the principles of transparency and data minimisation, as well as Google's retention practices," the DPC said.

Since January, the DPC here has been the lead supervisory authority for Google in Europe, offering a so-called "One Stop Shop" for data protection regulation across the EU.

The development comes at a time of growing pressure on the DPC to take stronger supervisory action around the data protection practices of big technology firms.

This latest statutory inquiry is the 19th by the DPC into large tech firms operating here, and its 54th overall.

11 of those open inquiries relate to Facebook alone.

Under GDPR, organisations can be fined up to 4% of their global annual turnover for breaching the rules.

Google had total revenues of $136bn last year. Its advertising business is its largest single source of income.

In a statement, Google said it would fully engage with the DPC's investigation.

It added that it would welcome the opportunity for further clarification of Europe's data protection rules for real-time bidding.

The internet company said that authorised buyers using its systems are subject to stringent policies and standards.