Appendix A
[IN CONFIDENCE RELEASE EXTERNAL]
Use of Facebook’s Custom Audience for advertising
campaigns
Brief Privacy Analysis
Prepared by:
Date:
About this Document
The purpose of this document is to demonstrate that privacy has been considered in a
project or process that involves personal information. The Analysis pulls together
relevant information to determine whether a full Privacy Impact Assessment (PIA)
should be completed and records IRs decision of why a PIA has not been done. It will
answer the following questions:
1.
Does this proposal involve a new way of managing personal information?
2.
Does the proposal raise a significant privacy risk for IR?
3.
Is a full privacy impact assessment required?
1.
Project summary: Data matching for advertising campaigns
1.1 Brief description of the project
This project is initially for advertising activity directed at Student Loans customers but
would be used more widely in marketing campaigns. For instance, using this service to
display banners to social policy customers without a myIR account
Currently we provide our advertising agency (FCB) with personal information in the form
of a list of email addresses and mobile numbers. This data is then ‘hashed’ (a way of
encrypting the data so it cannot be identified to anyone) and matched against Facebook
profiles and to be used in targeted advertising campaigns.
Facebook has increased the data matching capabilities to include more than just email
and mobile numbers. The new data types available for matching include:
•
First Name
•
Last Name
•
Postal Code
•
City
•
Date of birth
•
Gender
By providing this information we could greatly improve the results of the marketing
activities and direct more relevant messages to customers. In the case of Student Loan
overseas-based borrowers we currently have contact details (email and mobile numbers)
Classified in Confidence – IR Protected
[IN CONFIDENCE RELEASE EXTERNAL]
of approximately 55% of the population. If we were to use the full list of data types FCB
estimates we would be able to match 87% of the population.
This would greatly improve Inland Revenues ability to meet its objectives of increasing
repayments and increasing the contact details we have for overseas-based student loan
borrowers.
The main stakeholders or entities involved in this project will be:
•
Corporate Legal and Corporate Integrity & Assurance teams to advise any
changes required from a legal perspective
•
Marketing – to implement any changes required
•
Intel delivery – To provide the data
•
FCB – Receive the password protected data files and load the data to Facebook’s
system. Facebook provide FCB with a Custom Audience for advertising purposes
How Custom Audience works
Inland Revenue sends its advertising agency (FCB) a list of the people we wish to
present adverts to. FCB can create a customer list custom audience as they’re the
owner of an ad account connected to Meta Business Manager or the owner has provided
admin or advertiser permissions.
To make a custom audience from a customer list, Meta is provided with information
about existing customers and this is matched to Meta profiles. The information on a
customer list is known as an “identifier” (such as email, phone number, address) and is
use it to help find the audiences you want your ads to reach. Your customer list can
either be a CSV or TXT file that includes these identifiers.
A custom audience is created by adding a customer list into Meta Ad Manager and
selecting the identifiers to be used (name, email etc). Information in the customer list is
hashed and will be unidentifiable at an individual level. Hashing is a type of
cryptographic security method that turns identifiers into randomized code and cannot be
reversed. For example, for example, [email address] may come out hashed as
wLKziR/6RoXDv1MDaXLH1UNUC9nIVr97jrTnL4TcxsM=.
It’s important to note that hashing is one way; you can take an email address and hash
it, however you can’t take hashed data and turn it back into an email address.
After information in the customer list is hashed, it is sent to Facebook. Facebook uses
this hashed information by comparing it to its own hashed information and builds a
custom audience by finding the Facebook profiles that match. After the Custom Audience
is created, the matched and unmatched hashed information is deleted.
About custom audiences | Meta Business Help Center (facebook.com)
1.2 Personal information that the project will involve
In the table below, describe:
•
the personal information that will be collected, used and/or disclosed
•
the source of the information
•
the purpose of the information for your project.
Note: “Personal information” is any information about an identifiable living person.
However, a person doesn’t have to be named in the information to be identifiable.
Classified in Confidence – IR Protected
