IAB Europe has been informed by the Belgian data protection authority, the APD, that it has completed an investigation into IAB Europe’s privacy and data protection practices in connection with its role as Managing Organisation of the Transparency and Consent Framework (TCF). The APD’s report represents the preliminary views of the APD’s investigations unit and has no binding effect with regard to any breach of the law by IAB Europe.
While IAB Europe is currently assessing the APD’s report, we note that the findings point to a number of alleged compliance issues that stem solely from IAB Europe’s role as Managing Organisation of the Framework. We respectfully disagree with the APD's apparent interpretation of the law, pursuant to which IAB Europe is a data controller in the context of publishers' implementation of the TCF. If upheld, the APD’s interpretation would have a chilling effect on the development of open-source compliance standards that serve to support industry players and protect consumers.
The TCF is a voluntary standard whose purpose is precisely to assist companies from the digital advertising ecosystem in their compliance efforts with EU data protection law. It contains a minimal set of best practices seeking to ensure that when personal data is processed, users are provided with adequate transparency and choice. Its policies do not assist or seek to assist the processing of special categories of data. It does not intend to replace legal obligations nor enable practices prohibited under the law.
We find it regrettable that a standard whose requirements reflect an interpretation of the law that errs on the side of consumer protection and aligns with multiple DPA guidance materials across the EU (CNIL, DPC, ICO, etc.), should be the focus of an enforcement action, rather than an opportunity for a constructive, good-faith dialogue on how the TCF can be improved in ways that better align with the APD's vision and with consumer and industry needs.
Over the past three years we have had the chance to present the TCF to a number of European DPAs, whose feedback we reflected in important changes in the V2 of the Framework, rolled out earlier this year. We will be fully engaging with the APD over the coming months as its services conduct evaluations on the merits of the report. We will also continue to work with regulators and seek their guidance on how the TCF can promote compliance with both the GDPR and the ePrivacy Directive.
For more information, please contact:
Townsend Feehan, CEO, IAB Europe (firstname.lastname@example.org)
Helen Mussard, Marketing & Industry Strategy Director, IAB Europe (email@example.com)