Balancing Assessment for Legitimate Interest - Publishers
Contents
1.

Introduction ................................................................................................................................................ 1

2.

The Assessment .......................................................................................................................................... 2
2.1

Identifying a Legitimate Interest .................................................................................................... 2

2.2

The Necessity Test ............................................................................................................................. 2

2.3

The Balancing Test ............................................................................................................................ 2

2.4

Safeguards and Compensating Controls .................................................................................... 4

2.5

Reaching a Decision and Document the Outcome ................................................................ 4

1.

Introduction

This assessment has been prepared for Publishers with whom we have direct relationships, using theData Protection Network’s assessment template and guidelines.
Our contention is that, where we have a direct relationship with a publisher, we have been retained bythem to monetize their website. They have a legitimate interest in obtaining revenue to continue tooffer their website, and that is by definition in the interests of their users. It is possible to advertise
without using personal data (e.g. by contextual targeting, or no targeting at all), but these are inferior interms of revenue to the publisher, and in providing users with a service of more relevant ads.
We are not advancing the basis of legitimate interest for indirect relationships via SSPs or Exchanges. Inthose cases, we do not know with absolute certainty which websites are being monetized and thenecessary assurances are much less clear. While it may be possible to revise this (using strict white lists,for example), we are intending to use the legal basis of consent in such cases, via the IAB Europe
consent mechanism.

1

2.

The Assessment

2.1 Identifying a Legitimate Interest
What is the purpose of the processing Operation? To help monetize the publisher’s inventory bymeans of targeted advertising to their users.
Is the processing necessary to meet one or more
Our organisation depends on targeted advertising
specific organisational objectives?
– that is our revenue stream.
Is the processing necessary to meet one or more
The objectives are ours and the publishers.
specific objectives of any Third Party?
Does the GDPR, ePrivacy Regulation or other
The GDPR does include direct marketing as anational legislation specifically identify thelegitimate interest, although doesn’t mention
processing activity as being a legitimate activity,
online advertising explicitly in this regard.
subject to the completion of a balancing test andpositive outcome?

2.2 The Necessity Test
Why is the processing activity important to theController?

Online advertising is the purpose of ourcompany, and that includes residents of EU, andhas done for over 15 years.
We do not disclose the data to other controllers,
only processors who act on our behalf.

Why is the processing activity important to otherparties the data may be disclosed to, if
applicable?
Is there another way of achieving the objective?

Not as effectively; if we were not able to useusers’ personal data, we would need to fall backon contextual targeting. In the event contextual
targeting becomes as commercially effective in
helping publishers monetize their sites, we will
do so.

2.3 The Balancing Test
Would the individual expect the processing
activity to take place?
Does the processing add value to a product orservice that the individual uses?

Yes – this is the status quo for the publishers wealready work with.
Yes – the publishers we work with are entirely
funded by advertising, so would go out ofbusiness without this advertising.
No – we do not use the data for personalisingpricing.
No – we do not work with advertisers who serve
distressing ads, and the personal data we use
can’t result in a harmful breach. We also do notwork with sensitive ad content. We aresignatories to the NAI’s code of conduct, which
has strict guidance on e.g. health, sexuality topics

Is the processing likely to negatively impact theindividual’s rights?
Is the processing likely to result in unwarranted
harm or distress to the Individual?

2and ensuring cross-device linking has no
unexpected effects.
Financial harm

Would there be a prejudice to Data Controller if
processing does not happen?
Would there be a prejudice to the Third Party ifprocessing does not happen?
Is the processing in the interests of the individual
whose personal data it relates to?

Financial harm
Yes – to make their online advertising experience
more relevant. The ad revenue also funds wider
online content and better online services.
Yes – these are the users of the websites withwhom we have a business relationship.

Are the legitimate interests of the individualaligned with the party looking to rely on theirlegitimate interests for the processing?
What is the connection between the individual
and the organisation?

There is no connection between user andourselves save via the service we provide to thewebsite they are visiting.
Pseudonymous IP address (probably not uniqueto an individual), cookie id (unique to anindividual, but with no other identifiers) and useragent (not unique to an individual).
In most cases there will not be a two-way
relationship between the user and the website
they visit. Most of our partners do not havesubscribers or members.
No.

What is the nature of the data to be processed?
Does data of this nature have any special
protections under GDPR?
Is there a two-way relationship in place between
the organisation and the individual whose
personal information is going to be processed? If
so how close is that relationship?
Would the processing limit or undermine therights of individuals?
Has the personal information been obtained
directly from the individual, or obtained
indirectly?
Is there any imbalance in who holds the power
between the organisation and the individual?
Is it likely that the individual may expect theirinformation to be used for this purpose?
Could the processing be considered intrusive orinappropriate? In particular, could it be perceived
as such by the individual or in the context of therelationship?

Indirectly.

No, given the user can opt out of even the limited
data usage we rely on.
Yes, given that is the status quo.
As noted above, we do not work with any
potentially inappropriate ad content, topics or
cross-device delivery. The data is well protectedwith limited access, not shared with othercontrollers and retained only as long as strictly
necessary (see privacy policy for details).
Yes, this is mandated in our relationship with thepublisher and must be covered in their privacy
policy.

Is a fair processing notice provided to theindividual, if so, how? Are they sufficiently clear
and up front regarding the purposes of theprocessing?
Can the individual, whose data is being
processed, control the processing activity orobject to it easily?

Yes, they can easily opt out or contact us directly.
Opt-outs are also available via NAI, DAA, DAAC
and youronlinechoices sites.

3Can the scope of the processing be modified toreduce/mitigate any underlying privacy risks orharms?

As stated above, there are no privacy risks orharms.

2.4 Safeguards and Compensating Controls
1. We will never tailor ads to individuals that involve a specific price for a product based on theirprofile, that could mean a user pays a different price for the same product.
2. We will never knowingly serve an ad that could be distressing for any user.
3. We are signatories to the NAI Code of Conduct precluding using sensitive categories of data.
4. We will not transfer or sell any user’s personal data to any other controlling company.
5. We will retain the personal data in accessible form only for as long as necessary fortroubleshooting:• Log files: 60 days
• Profile: indefinitely, as long as the profile is active (90 days once it becomes stale)

2.5 Reaching a Decision and Document the Outcome
Outcome of Assessment:
On the basis of the available information, given the user will expect the scenario given it is the statusquo of long standing, and that the data involved bears no risk to the user in either usage or breach,
Legitimate Interest seems warranted.
Signed:Tim Sleath
Data Protection Officer & VP Product Management
19th April 2018

Review Date: 19th April

Reviewer: Dilip, DaSilva CEO

3.

Disclaimer

While we have taken legal advice in the preparation of this document from our counsel, Osborne Clarke,
the guidance above should not be taken as legally authoritative and if you have any concerns, youshould obtain independent legal advice.

4