RESOURCES

You need to assess whether there is a legitimate interest behind the processing.

• Why do you want to process the data?
• What benefit do you expect to get from the processing?
• Do any third parties benefit from the processing?
• Are there any wider public benefits to the processing?
• How important are the benefits that you have identified?
• What would the impact be if you couldn’t go ahead with the processing?
• Are you complying with any specific data protection rules that apply to your processing (eg profiling requirements, or e-privacy legislation)?
• Are you complying with other relevant laws?
• Are you complying with industry guidelines or codes of practice?
• Are there any other ethical issues with the processing?

Deliver and present advertising and content

Ozone needs to be able to deliver advertising, as that is its business, without the ability to deliver and present advertising we cannot fulfil our contracts with our publishers and our advertisers.

Ozone’s publishers and advertisers gain from our processing of the publishers’ readers consented data.

Ozone also creates a public benefit, as well as the direct commercial benefit it derives, as it provides revenue to premium publishers allowing them to re-invest in quality journalism. There is also a public benefit in the provision of freely available information on a free-to-use web through the provision of finance through advertising.

Ozone complies with the GDPR, the DPA 2018 and the e-privacy Regulation and appropriate local laws when supporting publishers in other countries.

Issues around targeted advertising are mitigated by the fact that Ozone’s only uses consented data and does not use Legitimate interest for any purpose other than this one.

You need to assess whether the processing is necessary for the purpose you have identified.

• Will this processing actually help you achieve your purpose?
• Is the processing proportionate to that purpose?
• Can you achieve the same purpose without the processing?
• Can you achieve the same purpose by processing less data, or by processing the data in another more obvious or less intrusive way?

The provision of targeted, or any other form of, advertising cannot be achieved without the delivery of the adverts.

The processing of personal data is limited to what is required for this purpose

You need to consider the impact on individuals’ interests and rights and freedoms and assess whether this overrides your legitimate interests.

First, use the DPIA screening checklist. If you hit any of the triggers on that checklist you need to conduct a DPIA instead to assess risks in more detail.

Nature of the personal data

• Is it special category data or criminal offence data?
• Is it data which people are likely to consider particularly ‘private’?
• Are you processing children’s data or data relating to other vulnerable people?
• Is the data about people in their personal or professional capacity?

No special category; criminal offence data; children’s or other vulnerable people’s data is processed. The technical data required to deliver and present advertising is unlikely to be considered particularly private.

The browsing of premium publisher’s website could be either personal or professional or both.

Reasonable expectations

• Do you have an existing relationship with the individual?
• What’s the nature of the relationship and how have you used data in the past?
• Did you collect the data directly from the individual? What did you tell them at the time?
• If you obtained the data from a third party, what did they tell the individuals about reuse by third parties for other purposes and does this cover you?
• How long ago did you collect the data? Are there any changes in technology or context since then that would affect expectations?
• Is your intended purpose and method widely understood?
• Are you intending to do anything new or innovative?
• Do you have any evidence about expectations – eg from market research, focus groups or other forms of consultation?
• Are there any other factors in the particular circumstances that mean they would or would not expect the processing?

Ozone does not have a direct relationship with the readers of their publisher’s websites. However, all Ozone publishers also adhere to the IAB TCF framework and have complaint CMPs which inform the data subjects of Ozone’s collaboration with their publishers and how to give or withdraw consent. The data is collected at the point of delivery of the advert.

Individuals are clearly aware of the that the websites they are landing on have advertising. It is generally known that personal data is processed in order to provide targeted advertising.

The processing is outlined in all Ozone Publishers CMPs.

Likely impact

• What are the possible impacts of the processing on people?
• Will individuals lose any control over the use of their personal data?
• What is the likelihood and severity of any potential impact?
• Are some people likely to object to the processing or find it intrusive?
• Would you be happy to explain the processing to individuals?
• Can you adopt any safeguards to minimise the impact?

This is very low impact with minimal impact on the control of individual data subject’s data. Ozone only also uses consented data so any individual can withdraw from targeted advertising as they see fit.

Can you offer individuals an opt-out? No

Can you rely on legitimate interests for this processing? Yes. The level of intrusion and amount of data used is low level and the commercial and public benefits of the processing could not be delivered without the processing.