Rise of the robots? GDPR to the rescue!

David Reed, director of research and editor-in-chief, DataIQ

Economic forecasters seem determined to cast artificial intelligence as The Terminator when it comes to jobs. If so, then the role of Sarah Connor may yet be taken by the unlikely figure of the General Data Protection Regulation. 

With draft guidance on profiling just issued by the highly-influential Article 29 Working Party - and the ICO having concluded its consultation ahead of publishing its official version - much attention has fallen on what this might mean for targeted advertising online. While opinions differ as to how to interpret both GDPR and the A29WP view, there are three points that seem clear enough.

Robots need human overlords

Artificial intelligence is used to automate routine, high-frequency activities - that is where its value lies. Ai is heavily embedded into the online advertising ecosystem because the sheer volume and complexity of interlinked processes - from profiling and ad serving to programmatic buying and header bidding - is beyond human management in real-time. 

Machine learning takes this even further by learning from other machines and data about outcomes in order to optimise processes. Machine-to-machine learning of this sort can have a profound impact and also rapidly becomes a black box which humans are unable to understand or explain.

What GDPR demands, however, is that a human safeguard must be in place. As the A29WP puts it, the review must be carried out by someone with appropriate authority and capability to change the decision. This is necessary if an organisation is using fully-automated decision making, where there could be a significant effect and where the firm is relying on consent.

For online advertising, this presents considerable difficulties. For one thing, many of those profile-based automated decisions happen a long way downstream from the advertiser. Even close to home, how a human marketer will actively engage with a decision and potentially over-rule it is hard to scope at the moment. But make no mistake, there will need to be an individual in final control of the robots.

Humans may feel the pinch

Many advertisers will argue that the decision to serve an ad or not does not have a significant effect. But this can be a highly subjective view. At the moment, targeted and personalised online advertising assumes that each person has no view of what another person is being served. Profiling is hidden from view, in other words, which in itself is no longer an option - GDPR says that online consumers need to be told what is going on.

It also says that the expectation of the individual has to be part of the assessment of whether profiling and automated decision making is having a significant effect. Most brands discriminate between the well-off and the poor, with those at the bottom of the spectrum usually paying more for products and services because risk has been priced in. 

But a consumer who needs a lower tariff for a service, for example, might expect to be shown the best offer which profiling can stop from happening. As privacy and consumer rights groups get to work on checking on GDPR compliance, they are likely to find out how these different socio-economic and demographic groups get treated, leading to complaints about discrimination on the basis of significant effects. 

Humans say no

If the automated decision made by profiling is likely to have a significant effect, then individuals will have the right to request a review of that decision. That could make things really complicated for online advertisers because alongside more transparency about what they are doing, they will need to build in the mechanism for this opt-out and resource the response (which has to be human, not automated).

Removing individual consumers from robotic control of targeting is no easy task. Not only is this a 24/7 activity, meaning humans need to be on hand at every time of day, but it is also very high volume. Marketing teams could get overwhelmed by the sheer number of requests to have a profiling decision reviewed and explained.

It is not surprising that the DMA has launched a robust response to the A29WP view and ICO consultation. As it stands, the entire digital advertising system could either freeze up or be found in non-compliance. What the regulators have in mind is clear - human dominance over robots. How organisations who have been betting on those robots to drive their business will cope could be the subject of many sequels to come.

Please note that blogs are the sole view of the author and that they are not neccesarily the view of IQ ddg Ltd and should not be interpreted as advice. Please read our full disclaimer

Director of research and editor-in-chief, DataIQ
An expert commentator on all things data, David has been editor of DataIQ since its inception in 2011.

You have....



to be GDPR compliant.

Register with us for all the news

Sign-up to hear about the latest DataIQ news, content and events.