BRUSSELS, BELGIUM - 7 March 2024: IAB Europe acknowledges the ruling handed down today by the Court of Justice of the European Union (CJEU) in connection with IAB Europe’s appeal of the February 2022 decision by the Belgian Data Protection Authority (APD) against IAB Europe and the Transparency & Consent Framework (TCF). This followed the Belgian Market Court’s interim judgement of September 2022 which referred questions to the CJEU for a preliminary ruling and held that the APD decision was insufficiently substantiated and failed to meet the relevant standard for proper investigation and fact-finding.
IAB Europe welcomes the CJEU ruling that provides well-needed clarity over the concepts of personal data and (joint) controllership, which will allow a serene completion of the remaining legal proceedings.
In particular, the judgement of the Court establishes that:
(i) TC Strings (digital signals containing user preferences) constitute personal data, even from the perspective of IAB Europe, when they can be linked with reasonable means to an identifier such as for instance the IP address of the device of the user and IAB Europe can have access to such data;
(ii) IAB Europe can be viewed as a joint controller together with TCF participants in relation to the creation and use of TC Strings by publishers and vendors, on the basis that the TCF provides specifications for its processing, if IAB Europe actually influences the processing (purposes and means) for its own reasons.
(iii) IAB Europe should not necessarily be viewed as a joint controller together with TCF participants in relation to the subsequent data processing performed in pursuit of the TCF purposes, such as digital advertising, audience measurement, or content personalisation since IAB Europe has no influence on such processing. The CJEU conclusion on the latter is particularly important, as the APD’s erroneous controllership qualification of IAB Europe over such processing served as a basis for the authority’s assessments of the validity of legal bases established through the TCF and corresponding sanctions.
The Belgian Market Court will now resume its examination of IAB Europe’s substantive arguments in line with the answers provided by the CJEU. Pending the conclusion of the proceedings before the Market Court which can take several months, the suspension of the execution of the APD decision (i.e. the implementation of IAB Europe’s action plan following its validation) continues to apply.
IAB Europe will be posting a more in-depth commentary of the ruling and of its consequences shortly. Although it was adopted specifically in the context of the TCF-related dispute before the APD, the findings of the CJEU are important for all organisations with digital activities.
An updated FAQ regarding the APD decision can be found on IAB Europe’s website, here.
Press contact:
Helen Mussard, CMO, IAB Europe - mussard@iabeurope.eu – +44 (0) 7399 919594
About IAB Europe:
IAB Europe is the European-level association for the digital marketing and advertising ecosystem. Its mission is to promote the development of this innovative sector and ensure its sustainability by shaping the regulatory environment, demonstrating the value digital advertising brings to Europe’s economy, to consumers and to the market, and developing and facilitating the uptake of harmonised business partners that take account of changing user expectations and enable digital brand advertising to scale in Europe.
