3

Communications Committee 

Corrected oral evidence: The Advertising Industry

Tuesday 12 December 2017

3.35 pm

Watch the meeting 

Members present: Lord Gilbert of Panteg (The Chairman); Lord Allen of Kensington; Baroness Benjamin; Baroness Bertin; Baroness Bonham‑Carter of Yarnbury; The Lord Bishop of Chelmsford; Viscount Colville of Culross; Lord Goodlad; Lord Gordon of Strathblane; Baroness Kidron; Baroness McIntosh of Hudnall; Baroness Quin; Baroness Stowell of Beeston.

Evidence Session No. 12              Heard in Public              Questions 115 - 122

Witnesses

I: Dr Michael Grenfell, Executive Director, Enforcement, Competition and Markets Authority; Miles Lockwood, Director, Complaints and Investigations, Advertising Standards Authority; Steve Wood, Deputy Commissioner, Policy, Information Commissioner’s Office.

USE OF THE TRANSCRIPT

This is a corrected transcript of evidence taken in public and webcast on www.parliamentlive.tv.

Examination of witnesses

Dr Michael Grenfell, Miles Lockwood, and Steve Wood.

Q115       The Chairman: Welcome to our witnesses for this session in our inquiry into the future of the advertising industry, a global, leading industry for the UK. We have been looking, in particular, at the skills and support it needs to maintain its global strength. Our witnesses today are all regulators. We are very grateful to you for joining us. What I would like to do, please, is to ask you each to say a few words to introduce yourselves and tell us about your relative responsibilities, the areas that each of you regulate. Also, perhaps, in your introductory remarks, tell us whether you see any difference between online and offline advertising, in terms of your approach to regulation.

Steve Wood: Good afternoon and thank you for giving me the opportunity to come and speak to you today. I am Steve Wood and I am Deputy Commissioner responsible for policy at the Information Commissioner’s Office. The Information Commissioner is the UK’s independent data protection authority, with responsibility primarily for the Data Protection Act 1998—particularly relevant to the online advertising space—and a companion piece of legislation called the Privacy and Electronic Communications Regulations.

It is important also to outline the scope and our focus in terms of the online advertising space. Our focus is on the protection of personal data, so personal data about living individuals. It is important to stress as well that the concept of personal data is fairly broad. Obviously, there are key characteristics that people would always recognise as personal data, such as someone’s name, address, et cetera, but also in the online space it is important that it encompasses unique identifiers that are used to single out and target information to individuals as well. The concept of personal data in the legislation is fairly broad to that extent; it can include things like IP addresses. There have been a number of cases in the courts over the last few years, including an important case in the Court of Appeal, that of Vidal‑Hall v Google, which clarified the scope of personal data. It is important to emphasise that that sits alongside our regulations, but that is our focus: the protection of personal data.

Our role will evolve over the next few years in terms of our focus. The Data Protection Act 1998, which is based on the European data protection directive, will be replaced by a new piece of legislation at European level, the general data protection regulation—GDPR—which will come into force in May 2018. This will be an important upgrade for the UK’s data protection laws. It will be a step change in terms of giving us the regulatory tools to tackle the issues in the digital economy. We would see it as an evolution rather than a revolution in terms of what is happening, but it is a step change in the new requirements for businesses regarding accountability, transparency and new rights for individuals to enable them to better control their data as well. Those are the key rights that are coming in, which will interplay in this particular area.

In addition, the GDPR gives us stronger powers, as a regulator, on things we have called for. We are going to have stronger powers to be able to issue fines. In the most serious cases, there could be fines of up to €20 million or 4% of global turnover, particularly focused on multinational companies. We are going to have a blanket power of compulsory audit, which will also give us greater tools to be able to work in this space. Lastly, the legislation includes an overarching concept that organisations have to give regard to, which is called “data protection by design”. This is a requirement for organisations to bake in considerations of data protection and privacy when they are designing their systems.

To answer your last question about the difference between the online and offline world, I guess that the intensity and complexity of data, which can be collected so rapidly in the online world, is the main challenge that we will focus on, as the regulator. The challenge of providing transparent and clear information for consumers in that space is a step change in terms of how that challenge needs to be focused on by all players in that area, by organisations and by us as the regulator. Therefore, the level of intrusion and the privacy risks are clearly greater. For example, an average citizen may have over 50 data relationships with organisations and the amount of data that they are now perhaps surrendering, or which is being collected from them in transactions where previously they would not have given away any data, is obviously changing. It is a matter of the intensity—the amount of data and the different ways that data can be collected, whether from a mobile device or a standard computer, et cetera—and how all that data comes together.

Dr Grenfell: Hello, and thank you for inviting me. I am Michael Grenfell; I am Executive Director for Enforcement on the board of the Competition and Markets Authority. We are not a regulator of a particular sector, like data. We have a cross‑economy remit and our remit is expressed in our one statutory duty, which is to promote competition for the benefit of consumers. The idea, as most of you will know, is that competition has the benefit for consumers that it puts pressure on businesses, if there is vigorous competition, to keep prices low and to keep quality and innovation high. Our functions are designed to ensure that there is adequate competition in the economy and to tackle any practices that seem to compromise, frustrate or restrict competition. We also have certain functions to enforce consumer protection law.

You asked whether there is a difference in our view between the digital and traditional worlds, and the answer is yes, and that is both a positive and a concerning difference. The positive aspect is that online commerce and digital outlets give people more choice, tend to offer lower costs and make it much easier for consumers to shop around. We all know that we can go on to a price comparison website and see reviews of products, whether it is hotels or goods in shops, and that enables us to be better informed consumers, which exerts more competitive pressure—which intensifies the process I have just described of downward pressure on price and upward pressure on quality and innovation. So there is better value for consumers.

But it also raises some new challenges, and we have been tackling some of those challenges using our various functions. For example, if you look at reviews online, it is terribly important, if they are to be trusted, that they are accurate. We have had to use some of our consumer protection powers a few times in the last couple of years to tackle practices where people faked reviews—they published false “positive” reviews—or where platforms supressed critical or negative reviews. People also are influenced as consumers by celebrity endorsements of products and services. Sometimes those endorsements are paid for but that is not disclosed to the consumer and, in that way, it misleads the consumer. We have taken steps to tackle that and will continue to do so.

When you look at a ranking of products or services online it may be that that ranking has been influenced by payment, in that whichever supplier pays the platform more gets the higher ranking. If that is not disclosed to the consumer it again distorts choice and competition. Indeed, we have just launched an investigation, using our consumer powers, into online booking sites for hotels and travel services where we want to tackle that concern. We had a market study which ended a couple of months ago where we looked at all aspects of digital comparison tools—price comparison websites and the like—and made some recommendations to ensure that they are made more accurate and consumers can have confidence in them. Just a few weeks ago we launched an investigation, using our competition law powers, into one price comparison website where we suspected that some of its practices were restrictive of competition. We are investigating that.

On the whole, we think they are a very positive development for consumers. There is a range of ways in which messages get across to consumers but, if outlets are not accurate or if they restrict competition, we will use our powers to tackle that, and we continue to do so.

Miles Lockwood: Thank you for having me today. I am Miles Lockwood; I am the Director of Complaints and Investigations at the Advertising Standards Authority. The ASA is the independent regulator for advertising content. We have been in existence for 55 years, and we are very active in the area of online advertising as well. We have been regulating online advertising since 1995, when we took on paid search, and then, with a significant extension to our remit in 2011, when we took on responsibility for regulating the content of advertisers’ advertising on their own websites and in social media as well.

We have the advertising codes, which we have regard to. They are written by the Committee of Advertising Practice and we administer them. The advertising codes are media‑neutral. They have been shown to have stood the test of time for many years. Decade after decade, we have demonstrated that, as we have extended our remit, as marketing techniques have developed and evolved, those advertising codes which provide a level playing field for advertisers across all types of media have been able to evolve. We have been able to do that by being nimble, effective and flexible in the way in which we apply those codes across the different types of advertising.

To answer your question about whether there is a difference between online advertising and other types, fundamentally, many of the issues that we experience and address as part of our regulatory work at the ASA are, in fact, as old as the hills; they have been around for a very long time. We have already heard talk about influencer marketing this afternoon. I had a look earlier on at the first annual report of the Advertising Standards Authority, in 1964, and guess what? One of the first articles in it was talking about how advertisers need to be clear about disclosing their ads when they are ads. We at the ASA encounter issues with advertising in the digital space, and sometimes they have the shock of the new because they look and feel very different, and this technology looks very disruptive, but what we are dealing with are sometimes issues that have been around for a very long time.

Having said that, there are issues that we are addressing. There are particular areas of concern that we have been very active in over the last few years, particularly since we took on, in 2011, regulation for the advertising of companies marketing on their own websites. A particular issue we face is that the barriers to entry to advertising are now much lower than they were many years ago. If you wanted to advertise on television many years ago, there were very limited resources to allow you to do so. Now, anybody can pick up a phone and engineer an advert if they want to. That is one issue we are facing. The nature of the advertisers, if you like, sometimes feels a little different, because we are often dealing with small enterprises—people who have not encountered the Advertising Standards Authority before and are less aware of our rules and the help they can get. So there is a big education role for us at the ASA. This year, with our sister body, we are looking to deliver 400,000 individual pieces of advertising advice to the industry, just to give you a flavour of the level of help that we are affording.

But there are issues, and we are very active in developing approaches to help address some of the issues we face, such as influencer marketing. Marketing to children online is a particular issue that we are looking at. Affiliate marketing is another area that we have looked at and where we are active in providing guidance and support to the industry to address those issues.

The Chairman: Thank you to our witnesses. You have raised quite a lot of issues there that I know members of the Committee want to talk to you about. In answering the questions, you may feel that some of them are more relevant to you than others. I am very happy for you to take that into account in your answers.

Q116       Lord Allen of Kensington: I am required to declare an interest in this area: I am chairman of Global Media and Entertainment; I am advisory chair of Moelis & Company, which is a bank that advises media companies and advertising companies; and I am a shareholder in ITV.

We have had the benefit over the last few weeks of listening to a number of witnesses and I would really welcome your response to some of the things they have said. We heard from Tess Alps, who is the chair of Thinkbox, and she stated, “The digital duopoly of Facebook and Google is not adequately regulated nor held to anywhere near the same standard as TV—or other media”. Marc Pritchard, the CMO of P&G, obviously a big advertiser, described digital media advertising as having a “murky, non‑transparent, even fraudulent supply chain”. There are some quite big challenges there. I would like you to take us through how the digital supply chain works and how transparent it is. What have you been doing to make it more transparent?

Miles Lockwood: I have listened to some of the evidence that has been presented to this Committee over recent weeks and one of the things that has struck me is that there have been frequent comments on how there is an issue with advertising regulation. In trying to make sense of that myself, it is important to draw a distinction between regulation of online editorial content and regulation of online advertising content. The ASA is the regulator for advertising content. We do not have responsibility and we cannot regulate online editorial. That is not part of our remit any more than it is our remit to regulate editorial in newspapers or other spaces; it never has been. Some of the issues that are being raised by the likes of Marc Pritchard, who gave a very important speech earlier this year and is an incredibly well-respected man from a well-respected company, raising very serious concerns about transparency and the supply chain. Those are very important issues that should be addressed but they are not directly issues for the Advertising Standards Authority, so we do not have a position, if you like, to take on some on some of those points. I hate to be unhelpful there, but it is not a direct issue for us.

Lord Allen of Kensington: Maybe we could move to Dr Grenfell, from a CMA perspective, because that was the angle as well; it was a commercial as well as an editorial aspect.

Miles Lockwood: Perhaps I can just address that point very quickly. Insofar as there are stakeholders saying they think there is an uneven playing field between television and digital, I take some issue with that. As I said in my introductory comments, the advertising codes provide a level playing field. If anything, over recent years we have seen a move towards convergence between television regulation and regulation of other areas. For instance, this summer the Advertising Standards Authority made a change to the regulation of high-fat, sugar and salt products in non‑broadcast media, which brings it much more into line with the high expectations that have been in place for broadcast television for a number of years. The fact of the matter is that there are always going to be some differences between television regulation and regulation in other areas; I suppose some of this is historical in nature. I am in my 40s and I remember that, as a young child, even back then, there was still some fear of “the box in the corner” that was “poisoning people’s minds”, and I had friends who were not allowed to watch ITV because parents thought that bad things might happen. That was then and this is now, but those concerns and the one‑to‑many nature of the communication method are always going to lead to some differences. However, it is not right to say that we hold digital advertising content regulation to a lower standard than we do with television. This year alone, we have taken steps, for instance, to require companies that are marketing online to give enhanced disclosure when they are marketing to young children. We have taken steps around targeting of protected products. There are various mechanisms by which we are saying, “You operate in the digital space; you need to go further”. It is equitable and fair, but we are active in both spaces.

Lord Allen of Kensington: What is the CMA perspective?

Dr Grenfell: I fear I am going to be less helpful than that, but let me make two points. The first is that we are giving particular scrutiny to online commerce and digital services. As I said earlier, although they are potentially very positive, they raise new issues. A high proportion of both our competition law cases and our consumer cases have been in this area. Our chief executive announced a couple of months ago, that to inform our analysis when we think there are concerns that we need to look into, we are establishing within the CMA a data unit so that we can be ahead of the curve, and understand and appreciate some of the difficult issues that these fast‑moving technologies raise.

Secondly, although I cannot comment on the murkiness or otherwise of the supply chain, I can say that we are determined that every element of the supply chain should be accountable and compliant with the law. To give one example, I spoke earlier about our work to ensure the fact that online celebrity endorsements have been paid for is not disguised. In one case, we made sure that we took action against the brand that was advertising, the marketing company and the platform, so that there should be a clear message that no element of the supply chain is immune from compliance with, in that case, consumer protection law, but it also applies to competition law.

Lord Allen of Kensington: Mr Lockwood said that basically a lot has not changed in 30 years, and I am just interested in how you have strengthened your teams in terms of digital expertise, because it is quite different, having been in the media business for a long time, from the old world. Have you felt that you needed to bring in new skills, new talent to try to tackle this? It is a question for all of you, but Dr Grenfell might kick off in terms of whether the CMA felt the need to bring in new skills and talent to help with this?

Dr Grenfell: Yes, we did, as I have just said. One or two other anti‑trust authorities around the world are recognising that now. This is not just in the area of digital advertising. There is a whole range of new issues that challenge competition authorities arising from data and digitalisation, such as the balance between “bricks and mortar” and digital commerce; or the fear that price‑matching software enables spontaneous collusion, and the fear, which is not yet tested, that existing ways of controlling collusion and cartelisation may not be up to the job. There is a huge amount that we are already doing and that we need to do in the coming years to look into these issues and we are now hiring experts to make that examination using our legal, economic, competition and consumer skills, but augmenting that with technical understanding of this sector.

Baroness Stowell of Beeston: Dr Grenfell, you said that you cannot comment on the murkiness of the supply chain, “murky” being the word used by Marc Pritchard. If the CMA cannot comment on the murkiness of the supply chain, who can?

Dr Grenfell: Lots of people can.

Baroness Stowell of Beeston: When you say you cannot comment on it, what do you mean?

Dr Grenfell: Our job is to protect consumers from practices that frustrate competition and from unfair trading and breaches of consumer protection law. We will do that. You will forgive me and understand that, because our decisions and our statements have legal effect, I am somewhat constrained from using the kind of colourful rhetoric that many speakers might use. The findings we make have to be evidence‑based; they have to follow thorough investigation; and our remit, when we do look into these things, is about whether there is a breach of the law and whether there is something that is affecting consumer welfare in terms of frustration of competition.

Steve Wood: I am happy to comment on the transparency aspect, particularly thinking about protection of individuals’ data.

Baroness Stowell of Beeston: By all means use your own language. It is the point I am trying to get at.

Steve Wood: Certainly from what we are learning from some of the work we have done, to answer some of the previous questions, we have had to take a step up in terms of our digital work at the ICO. We have invested in more technologists; we have a special laboratory where we look at mobile apps; we run what we call “cookie sweeps”, where we look at how websites are placing cookies and how that data collection process is working. We are particularly focused on how transparent that is to the consumer. We have also done work with consumer groups to try to understand, in general terms, how consumers can interact with the online world and how much they understand when they go on a website that is run by one company that the advertising they see is driven by a third party and the processes that underlie that.

Clearly, consumers can be presented with very complex explanations about how algorithms work, et cetera, but we think there is more that can be done, and it is going to need some innovative approaches to transparency to get consumers to interact in that world and to understand how their data is used. Hidden data collection, which could be aggregated data and evermore intrusive, probably will not be good for trust in the industry as well. One thing the current Information Commissioner is focusing on is transparency as a goal, particularly because that also drives trust in the digital economy. One of the surveys we ran found that only one in five consumers really trusted organisations with their data. We also asked questions about whether consumers were using tools like ad blockers. We are not necessarily condoning or endorsing their use but trying to understand what steps consumers were taking. Twenty‑six percent of respondents to our survey said they were using tools like ad blockers, which seems to indicate there is a growing sense of unease amongst consumers about how their data is collected in that space. They are reverting to tools like that to try to protect themselves.

Transparency is an important issue, and we need to do better and go further. The GDPR, which I mentioned earlier, has much stronger requirements and language and rhetoric around clear and accessible language to consumers. We are certainly going to take interest in that issue as a priority area, as a regulator, when the GDPR comes in next year.

Baroness Kidron: I was interested because in the written evidence, Miles, it says that you also regulate online behavioural advertising.

Miles Lockwood: We do.

Baroness Kidron: That speaks to what Steve was just explaining. I was wondering what the rules are. How do you regulate it?

Miles Lockwood: Online behavioural advertising is quite a small part of our total caseload. Advertisers, as you know, can put cookies on computers and use them to gain information about the interests and sites that a consumer is visiting and then OBA allows them to target relevant, you would hope, advertising. We have all seen it, have we not? I go online and search for a holiday and then I start being followed around by holiday adverts. The rules are quite simple. If you are an advertiser, you have to ensure that you are clear that you are employing online behavioural advertising to serve that ad and you have to also provide the consumer with a mechanism to opt out of it. There is a website that a consumer can go to if they are not happy to receive online behavioural advertising ads, you click some buttons and you opt out of doing so. As I say, we thought a few years ago this was going to be quite a big issue, but it did not transpire to become one.

Baroness Kidron: Just for clarity, is that because you are only dealing directly with advertisers? You do not deal with the third-party people who might be checking people’s behaviour in order to feed ads?

Miles Lockwood: We are dealing with the advertisers and the complainants, so if we receive a complaint from a member of the public we will investigate that.

Baroness Kidron: I understand that. I meant the middle people.

Miles Lockwood: No, we do not deal with the middle people.[1]

Q117       Baroness Bertin: Before I start, a few declarations from me: I work for BT and I was also recently asked to submit evidence to the CMA on the Sky/Fox merger in the capacity of my former government job as an adviser.

Just to probe a little bit on OBA, are you really happy that it is clear enough to the consumer? From my own personal experience, I am not completely convinced that I was aware that I was saying, “Yes, this is okay”.

Miles Lockwood: Each ad that serves you an OBA ad should contain within it a symbol that demonstrates that that ad is being served to you from OBA purposes.[2] That is the system we have in place and, as I say, we have received very low levels of complaints about it since we started regulating in that area of advertising some time ago. We have not seen it as an area where we have been receiving much feedback or feel there is a concern.

Baroness Bertin: Moving on to the ICO and your point about trying to raise public awareness of these issues, what is your timeline, for example? You are saying, “We need to do more”, but have you set yourselves a target internally?

Steve Wood: It is a combination of responsibilities here. Clearly we have a responsibility as the regulator to pull back the curtain and explain and reveal, sometimes through investigations but also through the guidance and awareness materials we put out for the public about how their data is used online. We also want to work with trade bodies and trade associations, so we will work with the IBA, the DMA, et cetera—with the players in this area—to make sure that the messages are getting out there.

Ultimately, the responsibility in law is on the companies themselves, as data controllers. Under the data protection law, they have a responsibility, ultimately, to be transparent and open about how they are using individuals’ data. It is a combination of all those actors taking responsibility to drive public awareness. But the key thing at the moment is the GDPR coming into force next year. We see that as a really good opportunity to raise the profile of how data really matters to individuals and how they can exercise their rights.

We are very mindful as well of whether, if individuals have 50 data relationships, they can get clear information that does not conflict. We are working with a consortium of organisations, such as the BBC and some big banks, including Barclays, to drill down and generate some baseline messages around data protection that are not legalistic, so that when companies are talking to their customers they are trying to use these baseline messages. We see the GDPR coming in next year as a really big opportunity to do that, so we are working with some key players. Obviously, we are only a regulator, so we are very much using the leverage and the ability of the BBC to try to get some of these messages out. There needs to be a step change in awareness and that is one of the key planks we are going to start to take forward next year.

Q118       Baroness Stowell of Beeston: I want to talk about market dominance, which, in a way, was probably what I was getting at when I intervened before. From the evidence that we have received from a lot of the witnesses, I understand that you, as regulators, are there to protect the public interest, but the bigger concern that seems to be raised amongst organisations that are having to operate in this new world is whether the regulatory regime that is in place is effective in managing competition and the market dominance of platform players. Not to go back to where we were, but the thing about the supply chain is that the issues we have heard raised have been not just about public concerns but about how it feels for the organisations that have to operate in this market.

As far as the leading platforms are concerned, if you have been following any of our evidence or reading any of the evidence that we have published, you will see the sorts of concerns that have been raised. Basically, they are about whether the regulation is effective enough. Dr Grenfell, in your recent lectures, you have raised questions about the regulatory regime and how effective it is, bearing in mind the dominance of the Facebooks, Googles and what have you. I just wondered if you wanted to talk to us a little about that.

Dr Grenfell: There is a clear prohibition. If a business is dominant and abuses that in some way, for example in ways that restrict competition or exploit consumers, that is prohibited. We look at many cases of abuses of dominance. You will know that just a few weeks ago the European Commission, which is also a competition authority that, for the moment, holds sway in this country, examined and found an abuse of dominance by Google that it said was illegal in terms of the way it treated competitors to its own Google Shopping site. The European Commission is also looking at other practices by that and other websites.

You might ask why the CMA does not look at those. The reality is that under these prohibitions, for the larger cases that have Europe‑wide or international aspects, the European Commission has the right to reserve investigations to itself and not to member states. Assuming that the effect of the UK leaving the EU is that those powers will return to the United Kingdom, you can expect that the CMA will tackle some of those global issues itself after we leave. We look at abuses of dominance, as does the European Commission, and we will have more remit to look at those larger issues post leaving the EU. That is the first point.

The second point is, as I said, that we have looked at and continue to look at practices, whether potential breaches of competition law or of consumer protection law, by websites and by platforms, to ensure that they are compliant, where we have the jurisdiction to do so. That, as I said a moment ago, is an increasing issue for us and why we are hiring expertise in the area of the digital and data sectors.

I would make one last point, which is a little bit like the point I made earlier. Clearly, saying that any particular company is dominant is a statement with legal effect; and without an investigation under any of these powers, obviously, we cannot do that.

Baroness Stowell of Beeston: As things stand at the moment as far as our membership of the EU is concerned, is it not possible for the CMA to do a market study of the digital advertising market? Could you do anything?

Dr Grenfell: Yes, it is possible for us to do market studies. We have just done a market study into digital comparison tools and price comparison websites. It is possible for us to do market studies into a range of things. Just last month, we completed a market study into residential care homes for the elderly. I would say two things on that. First, some of the people who have been before you have engaged with us and have suggested that we look into some of the concerns that you are talking about. We are in dialogue with them. We have asked them to come back to us with details of the consumer harm caused. Second—and I really must emphasise this—it is not our remit to solve all the social ills that this Committee has heard about, about fake news and so on. It is our remit to protect consumers from economic harm, and so we are engaging with them.

Baroness Stowell of Beeston: You have to follow the process, as it were, so if you think of, say, news providers, whether it is publishers, broadcasters or whatever, they are concerned with the dominance of platforms being such that it cuts off some of their revenue—revenue which allows them to make content that is of benefit to us as a society. However, their first approach to this concern is how it affects them as a business. What you are saying is that you are interested in this as it ultimately affects what is on offer and available to the consumer and you will engage at that point, but it is not your role to be concerned about their relationship commercially with these different sites.

Dr Grenfell: Precisely. It is a standard trope in our field that we are not here to protect one business against another business. Also, we are not here to solve all social ills, and I do not mean that flippantly. Some of the social ills that you have talked about are extremely serious and they need to be looked at, whether through legislation or government policy or whatever, but that is not within our powers and not within our remit. What is within our power is to protect consumers.

In answer to your point about a market study, we certainly do not rule market studies out. We do a range of market studies. We have done market studies on a range of work in these areas. We are engaging with some of the people who have spoken to you. I would also, though, say this one point. We are today focusing on digital advertising and the digital world, which is of enormous public interest and importance. You will appreciate that there is a wide range of issues that are also very serious and also of great public importance that compete for our attention. I mentioned residential care homes. We are also looking at and doing a lot of work on the cost of medicines that are supplied to the National Health Service. We are looking at what we think might be breaches of consumer protection law in the sale of secondary ticketing. That is nothing to do with what we are talking about here, but an awful lot of very serious issues compete for our attention. We have done a lot and will continue to do a lot in this space. We are engaging with the people who have seen you about issues that you have just raised. We certainly do not rule anything out, but we prioritise between a range of extremely important issues that compete for our attention.

Lord Gordon of Strathblane: Whether it is you or the EU, when you are looking at dominance, which universe are you looking at? Are online and offline two separate universes, or are they both competing for the one advertising dollar?

Dr Grenfell: That is an excellent question. It will depend on the sector. The question of how you define the market in which something is dominant is an economic question that is the staple of competition authorities’ investigations in this area. I am not going to prejudge that by an off‑the‑cuff comment now, but it would be a live issue in any investigation.

Q119       Lord Goodlad: I declare an interest as a member of the advisory board of GovNet Communications Limited.

You have talked very generously about the role of the CMA. Could you have a shot at briefly defining the role of the CMA in overseeing mergers and acquisitions in the digital advertising marketplace, and say what, if any, difficulties you are having?

Dr Grenfell: Absolutely. Our role on mergers and acquisitions in the digital advertising field is the same as it is in any other sector. We have a duty to scrutinise mergers and acquisitions that are above certain jurisdictional thresholds, to see whether they substantially lessen competition. For example, if you have two major competitors in the same sector and as a result of an M&A transaction they become one, we would look very carefully at whether that substantially lessens competition. We might prohibit it or we might see whether we can do a more proportionate measure short of prohibition. A large part of our work is scrutiny of mergers and acquisitions.

And there’s an EU aspect. For the very largest M&A transactions, the European Commission has exclusive jurisdiction and we do not. But the expectation must be that when we leave the EU, that will revert to us.

Lord Goodlad: Do you feel that you have the necessary technical expertise? Everybody around here is a lawyer. Is that a problem?

Dr Grenfell: That is a very fair question. The way we conduct our scrutiny of mergers and acquisition is a two‑phased process. There is an initial phase that lasts a few weeks where we see if there is a concern at all and, if not, we can clear it. If there is, we either clear it conditionally or go to a second, much more detailed phase, where a panel of eminent individuals will look in great depth, and that lasts five or more months. In the course of those investigations we take evidence from the parties themselves and from third parties, including many who have expertise. In that way, we familiarise ourselves with the technical issues involved, with the sector and so on.

When it comes to this area of digital, we have a sense that that might not be quite enough as we move forward. For that reason, as I said earlier, we want to augment that with a specialist data unit.

Q120       Viscount Colville of Culross: I would like to ask you about advertising standards in branded content. The ASA has told us that consumers should always know when they are being sold to. However, Dr Grenfell, in a speech in 2016, you said how concerned you were that there was undisclosed paid-for advertising that is indistinguishable from genuine reviews or endorsements. Last week, we spoke to a social influencer who said, of course, that she was extremely responsible about the way that she used paid-for brand advertising, I suppose you can call it, but did say that there was a need to be regulated much more effectively. What is your view on the need to increase advertising standards supervision in this area?

Miles Lockwood: This is one of the areas of greatest concern for us in the digital space. Since we have been regulating in this area, we have seen an increase in influencer marketing. It has become quite a common feature online. Now celebrities are using Twitter, they are joining up with brands and it is an issue that has gained some traction over the last year or two, so we have been very active in this area. From a very basic point of view, we have been producing a number of rulings over recent months that have called out this issue. That has, if you like, become the first stepping stone in our approach, which really does focus on education as a tool to help marketers understand their responsibilities in this area.

The rules are the rules. If you market something, if it is an ad, you have to make it obviously identifiable as such. We are finding that there are influencers and brands who are falling short of that and we realise that there is more work that needs to be done. In the early part of next year, we plan to commence a significant research project to look into this issue, because although we are making progress we do agree that there is more that needs to be done in this respect. The plans are being worked out at the moment, but we will be looking to conduct a literature review of the available evidence, both in the UK and abroad, to see whether our rules are in the right place and whether the requirements for disclosure are as good as they can be.

We will also be looking to conduct consumer research, to gain a better understanding as to what would be most helpful to consumers in terms of disclosure notices and advertisements. We have things like “#ad” for advertisement features and all these kinds of things at the moment, and they have grown organically through rulings that we have in place. However, it is an open question as to whether they are the most appropriate and useful tools to aid consumers in terms of disclosing these relationships, so we will be looking at this from a consumer research angle as well. We will also be looking at compliance. We will be looking across the market to see what the levels of compliance with our rules are, as they stand. If we find that there is an issue with that, we will take action next year. That is coming up in the next few months.

Dr Grenfell: We have been liaising with the Advertising Standards Authority to make sure we do not overlap and that we are working in a complementary way. It is a very big concern for us. As I have mentioned, we have taken a number of cases where we have been aware of that and, in terms of the supply chain, we have taken action in respect of the brands, the marketing companies and the platforms. It is very serious. We think that endorsements are a way that influences choice. It is good that choice is informed, but it is important that people are not misled in the information they are given, and not disclosing that an endorsement is paid for is a serious concern. When people come to us with evidence of what are really breaches of consumer protection law as regards misleading consumers, we will continue to take action.

So far, in terms of the results we have achieved in stopping these practices in individual cases that we have investigated, we have done so by getting the companies involved to give us binding undertakings. The sanction we have that induces them to do this is that we can go to court and get a court order if they fail to do so. What we do not have, as regards breaches of consumer protection law—we have it for competition law—is the power to apply civil law fines. We think we need that. I think the Government recognises that we need that, but clearly it is a matter of finding the legislative time for that.

Viscount Colville of Culross: Do the digital platforms have a responsibility to assist you in overseeing these advertising standards? Is there a problem that Facebook is not seen as an advertiser, for instance, and therefore you cannot move against them?

Miles Lockwood: Just to add one point to that, to balance this up a little, in the evidence you heard last week from the celebrity influencer, I was struck by one of the points that she made in her evidence to you. Somebody asked the question, “What is the compliance level of this?” and the response back from this individual was, “The big companies and the big brands know this now. The problem is with the smaller operators in this area”. I would just ask us to look at this from the context of this being a process, because this is very new. As I said earlier, this is the shock of the new. There are low barriers to entry with this kind of advertising and we have felt, ourselves, as though we have been on a process to educate the big brands to get them into compliance with our rules. We do feel now as though we are in a much better place and, in fact, when you go out there you can see talent agencies, brands and influencers calling out examples where they are spotting other influencers and other brands not disclosing as they should do. That has to be progress, because we are beginning to get the message across to the industry that they need to fall into line with these policies that we have. It is an ongoing process and, as we move into 2018, we will continue to work to educate and to get the smaller influencers, bloggers and celebrities to understand better what their responsibilities are.

As for Facebook, Google and online platforms, in terms of enforcement, we have very constructive relationships with these companies. When we spot a problem with an ad, when we rule against an ad and we uphold a complaint and publish it, we have always found these companies to be very supportive. They will work with us to take down material that is on their sites if we ask them to. We have worked with these companies also to produce online sanctions. Google has been very supportive of us in enabling us to put up our own advertisement against non‑compliant ads and to take down problem ads as well. Facebook have been supportive, in their own way, as well, so I do feel as though we are getting the support from them in terms of compliance with the rules, because at the end of the day it is in their own interest. It is not in Facebook’s or Google’s interest to have advertising on their site that is obviously dodgy.

The Chairman: Thank you. We have two more questions to put to you, so I am going to ask you to respond quite briefly and we may, in each case, want to write to you to follow up if we run out of time.

Q121       Baroness Kidron: I would like to ask Steve Wood this question. You have already said that you welcome the GDPR. Are people ready for it? What happens if they are not? What are we getting out of it? At the very top line, where is the benefit?

Steve Wood: The GDPR is a major undertaking, because data protection is horizontal, so it applies to all sectors—public, private and third sectors, essentially. We have a guidance programme on our website. We are working with different sectors and industries to make sure that they have the right information to help them prepare for the GDPR. We are particularly focusing on the small and medium‑sized enterprise area at the moment, because we know that those organisations may have fewer resources and less dedicated expertise on data protection to assist them. We have things like an SME toolkit on our website, which is more like a series of questions, and it guides people through to compliance. We have also set up a special helpline for small businesses, so a special number that they can contact us on. We are investing heavily in education so organisations can get things right first time.

We also have a general guide to the GDPR on our website. We relaunched that two weeks ago and have had 250,000 views of that document, which for us, as a regulator, is quite a lot. It indicates the interest in data and protecting that data at the moment, and shows that businesses are really starting to take it seriously. We are actively working to get that information out even to the smaller businesses and we need to work with networks to do that, because we do not have the whole megaphone to get that information out there. Particularly for the ad industry, we know that is diverse, so we will work with the industry bodies, as I mentioned earlier.

In terms of what happens if companies get this wrong, we have a range of tools in our box as a regulator. We have always been a risk‑based regulator. We also have to follow the Regulators’ Code in terms of our approach. Therefore, we would always look at the seriousness of the issue we are facing, the background, the history of the organisation, what they have done to contravene the rules, and whether there is an ongoing risk to individuals before deciding what action we can take. That can range from, under the GDPR, a reprimand and a warning, which could still be public; through to compulsory audit, just to help the organisation get it right, if they want to work with us and are willing to do that, or we can force the audit; through to corrective powers to stop an organisation using data in certain situations; and with fines there as well, as the ultimate sanction, which we are prepared to use. Indeed, we have already used our existing powers under the Data Protection Act to fine organisations.

The ultimate outcome of all this should be a more transparent ecosystem for personal data, where individuals feel more empowered and in control of their data and organisations feel more accountable for that data use, and with all of that coming together as a package, which means everybody has to do their bit. Will it all be ready and working perfectly by May 2018? I suspect it is a long journey and we need to have a long plan, as a regulator, to get there in stages in terms of the different things we need to do. However, we have a strategic plan for the current Commissioner going right up to 2021 to take us there.

Baroness Kidron: As a regulator, you do not have a view on this, but you must have had companies that are using this data for the purposes of advertising or targeted advertising, saying, “This is a problem for us because”, because it is changing their model. I am interested to know what the top complaint is about the GDPR from their point of view. Where do they see the barrier to business, if you like?

Steve Wood: Businesses have given some feedback about the requirements for additional transparency, particularly about how data is shared from third parties as well. They have to be transparent not just about how they are using the data, but about to whom they are disclosing it. If they have a long list of people they are disclosing it to, they say that is quite difficult to do. However, we think they have to be innovative in ways they can do that. They have to have layered notices in the way they explain that to individuals.

There are concerns about the higher standard of consent in the GDPR. There have been some myths around consent. For instance, some organisations think you have to have consent to process data—you do not: it is just one legal basis. There are other legal bases in the GDPR, such as the concept of legitimate interest, which you may be able to use in some situations. Some organisations are concerned about the higher standard of consent, but we are quite strongly defending the high standard of consent in the GDPR, because we think that when you use consent, it should mean consent, and it should not be illusory. If you cannot rely on consent, you should look to another legal basis in the GDPR and see if you can meet that.

Businesses are having to look at their business models again and at concepts in the GDPR, like the right to erasure. In the online advertising space, it might be quite difficult. If you exercise your right to erasure and your data is in a trail and there is an audit process, and many different parts of the chain with third parties, how is your personal data deleted and how is your consent revoked? The industry is going to have to work harder on interoperable systems to join all of this up, in terms of making it work in practice.

The organisations which are getting this right are saying, “We understand this, because consumer trust is not as good as it could be”. If there is more trust, people will supply more data, which means a higher quality of data and better personalisation; it will make the process work. There are lots of businesses standing alongside us on public platforms, saying, “GDPR is a good thing, because it is a step change towards trust as well”.

The Chairman: The final question will come from Baroness Quin. In part, some of you may wish to point to some publications your organisations have in respect of part of the answer to this question.

Q122       Baroness Quin: Yes, and to preface my question, if you have any information you can give us in writing, given the time constraints, as to how you operate internationally now, I would be interested to have it. What kinds of contacts do you have with your counterparts in other countries, and how do you see that continuing into the future?

My question is specifically on regulation post Brexit—if we ever get to that stage, I am tempted to add. I get the impression from things that have been said, including by you, Dr Grenfell, that you see some opportunities but also a lot of challenges in terms of the post‑Brexit environment. Specifically, how do you want to ensure that UK businesses are able to operate internationally? On the other side of the coin, how do you also want to ensure that companies overseas that are dealing with us will respect our standards, which in the future of course may not be the same as European Union standards?

Miles Lockwood: We are a founding member of the European Advertising Standards Alliance and the largest funder into that. Once we have left the European Union, assuming we do leave the European Union, we will remain a member of that. That body is quite influential in helping to shape and influence European policy in terms of advertising and law. We do see an opportunity for us on EASA to perform quite a helpful function here, even once we are outside the EU, in terms of helping to shape what is going on inside the EU through that body.

We are also a founding member of the international council for advertising standards, which performs a similar function on a global scale. It involves self‑regulatory organisations and other major players from the likes of the United States, Canada and countries in South America. We have some influence that we bring to the table in terms of that as well.

In other respects, we do not see Brexit as being of immediate concern in terms of the way we regulate. Most of the laws will transpose across. There may be one or two regulations that touch on things such as food and nutrition that are a greater issue. In general terms, I would say we have very good relationships with multinational companies. We are respected by the likes of Procter & Gamble and so on. Those relationships persist and enable us to ensure that we are regulating appropriately and keeping multinational companies on‑side.

Dr Grenfell: As I mentioned, particularly in mergers and acquisitions but also in investigations into cartels and anticompetitive practices, where the larger, more complex ones were previously reserved to the European Commission, one effect of leaving the EU is that those matters will be for us to deal with.

In terms of co‑operation with our sister agencies, it is certainly true that there are some EU‑wide bodies, both on the consumer‑protection side and on the competition side—networks—which in all probability we will no longer be part of. How are we addressing that? One is to strengthen very much our bilateral relations with other national competition and consumer‑protection agencies in Europe and, indeed, with the European Commission. Another aspect is at the global level. There is a global International Competition Network and a global International Consumer Protection and Enforcement Network which we are active members of—and we will become more so, both in terms of contributing to debates and of sharing know‑how and best practice about these issues, but also, particularly in the context of the International Consumer Protection and Enforcement Network, in terms of some joint action. We have already done some, and we will continue to do so.

Baroness Quin: Will there be extra costs? Have you thought about what the costs might be in terms of having a more active role?

Dr Grenfell: Yes. Having oversight of the larger mergers and the large cartels and so on clearly involves extra cost. How we do that is yet to be formally resolved, but our hope and expectation is that the Government recognise that and will provide the funding for that. As for international relations, we already devote resources to that and we will continue to do so.

Steve Wood: The issues with data protection are quite important at the moment, because we have a once‑in‑a‑generation change to our law, which last happened 20 years ago. The GDPR will be in force in May 2018. It has been very welcome that the Government have given the commitment to continue with the GDPR as the standard for UK data protection when we exit the EU. The implementation of that is taking place in the Data Protection Bill, which is passing through Parliament at the moment. That is very welcome.

The key issue and one of the key challenges post Brexit will be the basis on which personal data can flow from the EU to the UK. Currently, as a member of the EU, we are essentially regarded as part of the safe haven. Data is able to flow throughout the EU without any barriers, essentially. It is a frictionless flow of data. Those data exporters do not need to make an assessment of the level of data protection in the country they are transferring it to. If we were to exit the EU, we will become a third country in data protection terms. Therefore, the process in EU law is actually to assess the adequacy of the third country. Countries such as New Zealand are regarded as adequate in data protection terms and the data can flow. However, clearly a major concern of business at the moment is what arrangements we will have for data to be able to flow and to have some form of arrangements so there is not a barrier to data flow, because it is the lifeblood of the digital economy and the growth of many parts of the digital sector.

That is something the Government have recognised a lot. They also looked at data protection in one of the partnership papers they published in August about the negotiations. Data protection was one of the seven areas there, which we really welcomed. It showed that data was regarded as a key part of the digital economy.

We also just advocate continuing with the high standard of data protection in the UK. We have a long tradition of it. We have had a Data Protection Act since 1984, before some other European countries had one. It is a key issue for trust in the digital economy. There is a case for a high standard, regardless of the adequacy issue as well. Just very briefly as well, we have an international strategy, which we published on our website earlier this year. I will send a link to that to the Committee. Very similar to our other colleagues, we are also very actively engaged in international enforcement networks and linking up international investigations to deal with jurisdictional issues. The most live investigation we are involved in at the moment is the data breach involving Uber, which is a data breach that I am sure all of you have heard about. We are linking in with regulators in Europe and regulators in the US about that, just to illustrate our reach.

The Chairman: Thank you, gentlemen. Can I thank our witnesses for comprehensive answers and a substantial amount of briefing? We may ask you for a little bit more in writing, but you have all submitted evidence, which we are also very grateful for. Thank you for your time today.