Belgian data authority to pursue examination IAB Europe action plan

gdpr Image by Pete Linforth from Pixabay

The Belgian Data Protection Authority (APD) has informed IAB Europe that it intends to pursue its examination of the action plan submitted in April with a view to its possible validation. 

This is despite the Belgian Market Court’s interim ruling of 7 September, 2022 that declared illegal the APD decision (which served as a basis for the action plan) because of the APD’s lack of due care.

In addition, the Market Court has referred fundamental questions on the substance of the matter – and relevant to the action plan – to the Court of Justice of the European Union (CJEU).

The issue lays bare the highly complex and challenging route faced by the digital marketing world in trying to create a framework for consent from consumers over the use of their data.

IAB Europe said it welcomes every opportunity to enter into a dialogue with the APD, and other supervisory authorities concerned, on its action plan and how best to deliver extended functionality to the Transparency and Consent Framework (TCF). 

The action plan is the result of a careful assessment of what measures would best meet the APD’s interpretation of the GDPR, and the resulting obligations that it creates for IAB Europe. 

It reflects the willingness of the sector to find solutions and to cooperate on tools that are meaningful for data subjects, while practical and scalable for all market players involved.

However, while the action plan is a basis for discussion to continue the work on improving the TCF, IAB Europe said it firmly believes that the APD decision cannot be enforced.

First, the Market Court found that the APD’s decision was illegal due to irregularities at the stage of the APD’s investigation. 

Secondly, the measures proposed in the action plan stem directly from the assumptions that (i) the TC String (a digital signal containing user preferences) should be considered personal data and that (ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data processing done by TCF participants. 

The Belgian Market Court has decided to seek guidance from the CJEU on both of these points, based on questions raised by the APD itself during the course of the proceedings.

IAB Europe said it reserves the right to engage in any form of available legal action should the APD attempt to enforce its illegal decision and preempt responses from the CJEU on the central issues that have been referred to it

“The questions that have been referred to the CJEU are foundational as they call into question whether an enforcement action should have been brought against IAB Europe in the first place,” said Townsend Feehan, CEO of IAB Europe. 

“Pending the answers from the CJEU on the matter, we look forward to soliciting guidance from Data Protection Authorities to deliver extended functionality to the TCF.”

An updated FAQ on the case may be consulted on IAB Europe’s website here.

What happened earlier in the year:

IAB Europe responds to Belgian authority TCF data ruling