The Irish Data Protection Commission announced the start of an investigation into Google's advertising business. In particular, it's concerned about how Google processes personal data for its online Ad Exchange.
The regulator said it wants to establish whether processing of personal data carried out at each stage of an advertising transaction is in compliance with the relevant provisions of the EU's General Data Protection Regulation (GDPR). The GDPR principles of transparency and data minimisation, as well as Google’s retention practices, will also be examined.
The investigation was opened following a number of complaints, including from the web browser developer Brave. It claims Google's sharing of personal data on web browsing with numerous companies in the online ad auction system fails to protect user data from unauthorised access. The GDPR requires data processing companies to protect the personal data from such breaches or loss.
Brave filed the complaint last September, also to the UK data protection regulator, along with the Open Rights Group.
