Series
Blogs
Series
Blogs
Autocontrol, the Spanish not-for-profit association that acts as a self-regulatory and supervisory body for the advertising industry in Spain, has recently published a revised code of conduct on the processing of personal data for advertising activities (the "CoC”). The code covers both traditional direct marketing and online targeted ads.
The revised CoC has been approved by the Spanish Data Protection Agency (the “AEPD”) and recently came into effect. It provides for, among others, a nimbler online out-of-court dispute settlement mechanism for resolving data protection disputes between adhering entities and data subjects.
The GDPR sets out that associations and other bodies representing categories of controllers or processors may prepare codes of conduct to specify the application of the GDPR, such as with regard to the legitimate interests pursued in specific contexts, the collection of personal data, and out-of-court proceedings and other dispute resolution procedures.
Autocontrol is made up of the main advertisers, advertising agencies, media, and professional organisations involved in advertising activities in Spain. Currently, it has over 600 members, which are involved in approximately 70% of all advertising-related investments in Spain.
Autocontrol adopted its initial CoC back in 2020 for the main purpose of adopting an out-of-court dispute settlement mechanism for complaints in data protection advertising. This was the first GDPR approved CoC with an accredited monitoring body in the EU.
Since then, technological advances have transformed the advertising industry. Phenomena such as big data and AI allow advertisers to scale ad placements and reach wider audiences, and cookies enable them to tailor and personalise ads based on users’ interests, habits, and demographics. Nevertheless, these developments have brought new challenges for the protection of users’ personal data, which led Autocontrol to revise its existing CoC.
The CoC applies to the processing of personal data for advertising purposes carried out by adhering entities. This includes sending direct marketing communications and using cookies and other technologies for targeted advertising.
Its scope of application is limited to those processing activities that are carried out by adhering entities in Spain, or that affect data subjects located in Spain where such processing relates to the offering of goods or services to data subjects in Spain, or involves the monitoring of the behaviour of data subjects in Spain.
Generally, any company or entity processing personal data in the context of an advertising activity may adhere to the CoC, regardless of whether they were previously associated with Autocontrol. Participation in the CoC is voluntary, but it becomes legally binding for entities that adhere to it.
Under the CoC, adhering entities undertake to comply with the GDPR and other data protection laws when carrying out their advertising activities. This includes:
The CoC sets forth an online updated out-of-court procedure for resolving data protection disputes between adhering entities and data subjects in relation to the processing of personal data carried out in the context of advertising activities.
The CoC also sets out the sanctions to be imposed by the Advertising Jury in case of infringement. Sanctions range from a private and public reprimand in case of minor infringements, to the temporary suspension of the rights conferred to in the CoC in case of serious infringements, and to the expulsion from the scope of the CoC in case of very serious infringements. The suspension of the rights or expulsion of the adhered entity will be notified to the AEPD.
This revised CoC is expected to serve as a guide for companies to process personal data in the development of their advertising and marketing activities in compliance with data protection regulations. Important players in the advertising sector in Spain, such as Atresmedia (Antena 3), Dentsu, Ikea, L’Oréal, MásMóvil, Orange, Procter & Gamble, Telefónica and Vodafone, have already adhered to it.
It will also allow data subjects to resolve their data protection claims in a more agile and simple manner through the updated online out-of-court procedure.
23 February 2023
Up next