Dr Johnny Ryan, Senior Fellow of the Irish Council for Civil Liberties (the Council) brought a legal action in the Hamburg District Court over secret dossiers on Wednesday. While the lawsuit specifically targets technology giants including Google, Facebook, Twitter and Amazon, as well as cellphone service providers, it aims more broadly to challenge online advertising and “real-time bidding.”

In a press statement, the Council explained that secret dossiers are collections of information about internet users, which can include information about a user’s mental health, location, political views, religion, finances and children’s health needs. Real-time bidding broadcasts these dossiers to “thousands of companies.” Thereafter, “automated auctions take place in real time for the advertising spaces contained on a website while it is loading.” The Council included a wealth of industry documents in evidence indicating that technical measures are not in place to restrict companies’ use of and sharing of dossiers.

The Council said that data breaches through the dossiers used in real-time bidding happen “hundreds of billions of times a day,” breaching the General Data Protection Regulation (GDPR) every time. However, the GDPR enforcers have not taken action to stop such practices for three years.

Under article 13 of the GDPR, internet users whose personal data is collected must be provided with a variety of information from the collector of the data including the name of and contact information for the data controller, the intended purpose of the personal data and, if relevant, the controller’s intention to transfer that user’s personal data to a third party. Under article 12(1) of the GDPR, the data controller must “take appropriate measures to provide” that information “relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language”.

Article 26(2) provides that when there are two or more controllers of information, “the essence of the arrangement” must be “made available to the data subject”.

Ryan commented:

These secret dossiers about you–based on what you think is private–could prompt an algorithm to remove you from the shortlist for your dream job. A retailer might use the data to single you out for a higher price online. A political group might micro target you with [personalized] disinformation.

If the lawsuit is successful, the online advertising industry will have to cease tracking internet users through secret dossiers.