Irish Council for Civil Liberties

Find out how you can support our vital work
Home / Archives for Johnny Ryan

Irish Data Protection Commission inaction means Irish people with AIDS were profiled, Polish elections were influenced, and the biggest data breach in history continues.

21 September 2020

A new ICCL report reveals that failure by the Irish Data Protection Commission (DPC) to stop a massive data breach at the heart of the online advertising industry is allowing illicit profiling of Irish people by data broker companies. Irish people’s health conditions, political views, and whereabouts are analysed and sold in a dark data market.

The ICCL report also includes a proven case of electoral influence, profiling of Irish people with AIDS and other conditions, and a list of the nine hundred and sixty eight companies that Google sends information to about the private things that people do and watch online.

“It is unacceptable that the largest data breach ever recorded should be permitted to continue more than two years after the DPC was made aware of it”, said Liam Herrick, director of ICCL. “Continued failure will further harm citizens, and damage Ireland’s reputation.”

The data breach occurs in online advertising’s Real-Time Bidding (RTB) system, which is an open secret operating behind the scenes on websites and apps. RTB constantly broadcasts everyone’s online actions, and where we are in the real-world, to a vast array of companies. There is no technical limit on what those companies then do with our secrets, or who they share them with. Watch a video explainer on RTB here.

This infringes Article 5(1)f of the EU’s General Data Protection Regulation, which requires that personal data be kept secure. It is the biggest data breach ever recorded, leaking our secrets hundreds of billions of times per day. It is two years since the DPC was first formally notified of this by Dr Johnny Ryan, now a Senior Fellow of the ICCL. But as today’s report shows, the problem has grown even more acute over the past two years.

Dr Ryan said “Today, two years after I formally notified the DPC about the RTB privacy crisis, my intimate data continues to be broadcast to countless companies through the RTB system. So does yours.”

Because of the DPC’s key role as Google’s GDPR supervisory authority for all of Europe, its failure to act has international implications. International digital rights lawyer Ravi Naik, who represents Dr Ryan, said “the DPC’s inaction has led to a blockage of enforcement against these practices across Europe. This is an intolerable situation for such wide-scale abuses and the DPC needs to act for this illegal conduct to end.” 

Today’s ICCL report also brings to light documentation from the data industry, revealing that it attributes characteristics such as “infertility”, “STD”, or “Conservative” to each of us. The report also shows how data brokers used RTB data to profile LGBTQ+ people to influence last year’s parliamentary election in Poland, tracked the movements of people in Italy during the lockdown, and profiled Black Lives Matters protestors.

Dr Ryan’s Irish solicitor, Gerard Rudden, said ““The scale of the data breach identified and exposed by Dr Ryan in his complaint is astonishing. The regulator has a duty to act with all due diligence. It is extremely concerning that 2 years have passed, during which time the problem has grown significantly, and no decisive action seems to have been taken.” 

ENDS/

Full report, key insights, letter to Minister for Justice and appendices here:

https://www.dropbox.com/sh/7xo77grl2mnb6b6/AAAlszXoQ_zM2kUSsSRqKJSqa?dl=0

Find a video explainer on RTB here: https://vimeo.com/451973748

For comment: Dr Johnny Ryan, Liam Herrick

For media queries: Sinéad Nolan sinead.nolan@iccl.ie 087-4157162

New data on the RTB privacy crisis: people with AIDS profiled in Ireland, and Polish elections influenced.


This note presents new evidence of the scale of the vast RTB data breach, and of the consequences of two years of failure to enforce. 

September 2020 is the two year anniversary of my formal complaint to the Irish Data Protection Commission about the Real-Time Bidding privacy crisis. In these two years, RTB has been allowed to continue to infringe Article 5(1)f of the GDPR, which requires security of personal data. In fact, this vast data breach appears to have worsened. 

Today, we at the ICCL submitted evidence to the DPC that show the consequence of failure to enforce the GDPR to stop the vast RTB data breach at the heart of the online advertising industry.

This evidence includes a proven case of electoral influence, profiling of people with AIDS and cancer, and a list of 968 companies that Google sends information to about the private things that we do and watch online. 

See the materials

Key insights in the submission  

  • Real-Time Bidding operates behind the scenes on websites and apps. It constantly broadcasts the private things we do and watch online, and where we are in the real-world, to countless companies. As a result, we are all an open book to data broker companies, and others, who can build intimate dossiers about each of us. Google’s RTB system sends this data to 968 companies (see Appendix F for a 25 page list of these companies). 
  • A data broker company that uses RTB data to profile people influenced the 2019 Polish Parliamentary Election by targeting LGBTQ+ people. See page 5. 
     
  • Google’s RTB system allows users to target 1,200 people in Ireland profiled in a “Substance abuse” category, based on a data broker profile built with RTB data. Other health condition profiles from the same data broker available via Google included “Diabetes”,  “Chronic Pain”, and “Sleep Disorders”. See page 6. 
     
  • The IAB’s RTB system allows users to target 1,300 people in Ireland profiled in a “AIDS & HIV” category, based on a data broker profile build with RTB data. Other categories from the same data broker include “Incest & Abuse Support”, “Brain Tumor”, “Incontinence”, and “Depression”. See page 6. 
     
  • A data broker that gathers RTB data tracked the movements of people in Italy to see if they observed the Covid-19 lockdown. See page 11-12. 
  • A data broker that illicitly profiled Black Lives Matters protesters in the United States has also been allowed to gather RTB data about Europeans. See page 9. 
     
  • The industry template for profiles includes intimate personal characteristics such as “Infertility”, “STD”, and “Conservative” politics. See pages 13-15. 
     
  • RTB is the most massive data breach yet recorded, involving millions of websites and apps, and hundreds of billions of individual data leaks per day. Google’s RTB system now sends people’s private data to more companies, and from more websites than when the DPC was notified two years ago. A single ad exchange using the IAB RTB system now sends 120 billion RTB broadcasts in a day, an increase of 140% over two years ago when the DPC was notified. See pages 16-18.
See the materials
Image: a sample from data broker “OnAudience”, showing that 2,300 people in Ireland have been classified as suffering chronic pain, and can be purchased via Google’s RTB system, or through the IAB’s RTB system using The Trade Desk or Ad Form. Another sample shows that 200 people in Ireland have been classified as being interested in “Incest & Abuse Support”. 

Video: the RTB privacy crisis

Video: Overview of the RTB Privacy Crisis

Dr Johnny Ryan takes up new privacy role at ICCL

6 August 2020

The Irish Council for Civil Liberties (ICCL) is delighted to announce that Dr. Johnny Ryan FRHistS is joining ICCL as a Senior Fellow on our Information Rights Programme. 

The Irish Council for Civil Liberties is Ireland’s oldest independent human rights organisation, and has campaigned on data rights for two decades. ICCL has won major data rights cases at the Irish and European Courts, and leads the International Network of Civil Liberties Organisations work on information and privacy rights. 

ICCL Executive Director, Liam Herrick said:

“Johnny is a global figure in the tech industry. He exposed the vast data breach at the heart of the online advertising industry, and triggered regulatory investigations at Google and the Interactive Advertising Bureau, two bodies that define the rules for much of the online advertising industry.”

Dr. Ryan joins ICCL from Brave, where he was Chief Policy & Industry Relations Officer reporting to CEO Brendan Eich, the inventor of JavaScript. Dr Ryan’s regulatory interventions made the front page of The Financial Times, and his expert commentary regularly appears in media such as The New York Times, The Economist, Wired, Le Monde, and others. 

Dr Ryan said 

“What happens in Dublin has global consequence. Big tech’s data use across the EU is regulated from Dublin. Failure to enforce the GDPR here puts all European citizens in jeopardy. I am joining ICCL to focus all of my energy on holding Big Tech – and its enforcers – to account.” 

Dr Ryan’s appointment was made possible following ICCL receiving a grant from global philanthropic organisation, Luminate. The grant was awarded as part of Luminate’s work on Data & Digital Rights, which ensures the rights of people and communities are upheld in the design and use of data and technology.  

ENDS

Links 

For comment: Elizabeth Farries, Dr. Johnny Ryan. 

Media queries: Sinéad Nolan: sinead.nolan@iccl.ie 087 4157162

News and EventsOur OrganisationInternational Partnerships

Contact ICCL

Irish Council for Civil Liberties,
Unit 11, First Floor, 34, Usher's Quay,
Dublin 8

Phone: +353-1-9121640
Email: info@iccl.ie

Privacy Notice

Cookies Policy

Sign up for our Newsletter

Stop the Card and Delete Our Data!!

The Data Protection Commissioner has said the government has no legal right to insist on the card for services outside of welfare.
If you have a card, your personal information could be used unlawfully and stored in a way that makes it vulnerable to theft.

Donate now

and help us fight this!