The Belgian Data Protection Authority (APD) has informed IAB Europe that it intends to pursue its examination of the action plan submitted in April with a view to its possible validation. This is despite the Belgian Market Court’s interim ruling of September 7th 2022 that declared the APD decision (which served as a basis for the action plan) illegal because of the APD’s lack of due care. In addition, the Market Court has referred fundamental questions on the substance of the matter – and relevant to the action plan – to the Court of Justice of the European Union (CJEU).
IAB Europe welcomes every opportunity to enter into a dialogue with the APD, and other supervisory authorities concerned, on its action plan and how best to deliver extended functionality to the Transparency and Consent Framework (TCF). The action plan is the result of a careful assessment of what measures would best meet the APD’s interpretation of the GDPR, and the resulting obligations that it creates for IAB Europe. It reflects the willingness of the sector to find solutions and to cooperate on tools that are meaningful for data subjects, while practical and scalable for all market players involved.
However, while the action plan is a basis for discussion to continue the work on improving the TCF, IAB Europe firmly believes that the APD decision cannot be enforced.
Firstly, the Market Court found that the APD’s decision was illegal due to irregularities at the stage of the APD’s investigation. Secondly, the measures proposed in the action plan stem directly from the assumptions that (i) the TC String (a digital signal containing user preferences) should be considered personal data and that (ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data processing done by TCF participants. The Belgian Market Court has decided to seek guidance from the CJEU on both of these points, based on questions raised by the APD itself during the course of the proceedings.
IAB Europe reserves the right to engage in any form of available legal action should the APD attempt to enforce its illegal decision and preempt responses from the CJEU on the central issues that have been referred to it
Townsend Feehan, CEO of IAB Europe, commented: “The questions that have been referred to the CJEU are foundational as they call into question whether an enforcement action should have been brought against IAB Europe in the first place. Pending the answers from the CJEU on the matter, we look forward to soliciting guidance from Data Protection Authorities to deliver extended functionality to the TCF. ”
An updated FAQ on the case may be consulted on IAB Europe’s website here.
