The Belgian Data Protection Authority (APD) issued its decision in connection with its investigation of IAB Europe.
The decision confirms the finding that IAB Europe is a data controller of the TC String, which the APD considers to be personal data. A number of remedies are imposed, including a fine of EUR 250k. IAB Europe is required to submit an action plan within two months to address the purported infringements in relation to its own role in the TCF, and then to execute the plan over a six-month period once the APD has approved it. The APD is also using the opportunity of the ruling to require changes to the TCF, including that legitimate interests be excluded as an available legal basis for at least certain data processing purposes.
The TCF has not been banned, as the complainants had sought in their original complaints and throughout the proceedings. It remains the industry’s most important instrument for ensuring compliance with certain requirements of EU privacy and data protection law in connection with the delivery and measurement of digital advertising, which is why the APD decision requires IAB Europe to develop and execute the action plan.
IAB Europe has posted a statement in response to the decision by the APD on its website here for your reference.
Further updates on the ruling and next steps for TCF and the digital advertising industry will be provided.
IAB Ireland
3 February 2022
