FDPIC concludes investigation into the Ricardo auction platform with recommendations
Bern, 23.10.2024 - The Federal Data Protection and Information Commissioner (FDPIC) concluded his case investigation into the Ricardo auction platform on 11 April 2024. In his final report, he recommended that Ricardo AG and the TX Group AG make data transfers and cross-platform tracking for the purpose of targeted advertising transparent and obtain valid consent for these practices from their users.
As part of his case investigation, opened on 4 September 2017 and carried out under the previous Data Protection Act, the FDPIC analysed the data-related procedures and processes in detail, from the collection of data on the Ricardo platform to the display of personalised advertising, including the transfer of data to the TX Group and the subsequent data processing and linking with other data sources.
In his analysis, the Commissioner concluded that Ricardo and the TX Group were processing personal data, particularly as the data on the users were always linked to a unique pseudonym. He also found that the cross-platform tracking led to the creation of personality profiles and that Ricardo members were not adequately informed about the tracking and the subsequent use of data for targeted advertising. The resulting breaches of privacy could not be justified by the overriding private interests that Ricardo and the TX Group claimed. Furthermore, valid consent was not obtained, not least because users of the Ricardo platform were not adequately informed about the data processing. The FDPIC therefore recommended that the deficiencies identified be remedied by making appropriate changes to the auction platform.
During the proceedings, which were initiated under the previous Data Protection Act, the data processing and privacy statements were amended several times. This and the associated extended enquiries meant that the FDPIC had to repeatedly adjust his findings on the complex facts of the case during the ongoing investigation until they were formally established as of 12 May 2023. These adjustments contributed to the fact that the case investigation carried out under the previous law could only be completed after the new Data Protection Act came into force.
At the request of Ricardo and the TX Group, the FDPIC is publishing a redacted version of his final report. Both companies dispute the report's conclusions and describe the FDPIC's recommendations as legally untenable overall. In particular, they argue that the data transmitted to the TX Group does not constitute personal data and that the Data Protection Act therefore does not apply. Ricardo and the TX Group also consider the FDPIC's recommendations to be redundant, arguing that they relate to a situation that no longer exists and legislation that is no longer in force.
If the FDPIC determines that the deficiencies identified on the basis of the findings established on 12 May 2023 persist, he reserves the right to take appropriate measures to have the required adjustments to the Ricardo platform carried out.
Address for enquiries
Information
Feldeggweg 1
3003 Bern
Publisher
Federal Data Protection and Information Commissioner
https://www.edoeb.admin.ch/edoeb/en/home.html
Last modification 23.07.2024