IAB europe and the TCF: The case goes to the highest European Court  (September 2022)

On September 7th, the Interactive Advertising Bureau (IAB) Europe released a statement acknowledging an interim ruling from the Belgian Market Court (part of the Brussels Court of Appeal), in connection to the appeal of the February 2022 decision by the Belgian Data Protection Authority (APD) about the Transparency & Consent Framework (TCF).

In this article, we bring clarity about what this latest ruling means by breaking down the decision, what the next steps are, and the actions you can take today to prepare.

Summary

• The Belgian APD decision on IAB Europe’s TCF: What’s new?

• What are the questions asked by the Belgium Court of Appeal to the Court of Justice of the European Union (CJEU)?

• What does that mean for your business and how to get ready?

What’s new with the Belgian APD decision on IAB Europe’s TCF?

Earlier this year, the Belgian Data Protection Authority (the APD: Autorité de Protection des Données) issued a complaint relating to Transparency & Consent Framework (TCF), citing 4 key issues with the framework:

• The Transparency & Consent (TC) string is deemed personal information, and as such requires a legal basis from participants (consent, legitimate interest, or else)
• IAB Europe is a data controller of that information, even if it doesn't process the consent information
• IAB Europe is a joint controller with other TCF participants (vendors, CMPs, publishers). Consequently, the Belgian APD considers that it failed to establish a legal basis for processing the TC string
• The security measures in place to protect the integrity of the consent signal were not sufficient.

IAB Europe was fined EUR250K and instructed to come up with an action plan, but appealed the Belgian APD ruling shortly after. 

The Brussels Court of Appeal dismissed 5 of the 8 grounds for appeal in its official ruling, but sent two out of the remaining three for review to the Court of Justice of the European Union (CJEU), the highest authority of European Union Law, which notably had the last word in the Schrems II case.

As it stands, the appeal is suspended pending the CJEU’s response, upon which the Belgium Court of Appeal will finally be able to declare a ruling. That might take at least a year, with two possible outcomes: 

• The initial Belgian APD decision is dismissed
• The initial Belgian APD decision is confirmed and IAB Europe will have to get an action plan validated by the APD.

But what are the two grounds for appeal the Court of Justice of the European Union (CJEU) is tasked to examine?

What are the questions asked by the Belgium Court of Appeal to the Court of Justice of the European Union (CJEU)? 

In essence, the two key questions that the CJEU will have to study and take a stand on are:

• Should the consent string be considered personal information?
• Can IAB Europe be considered a data controller of the personal information contained in the consent string?

The answer to both these questions will have far-reaching consequences on the privacy landscape and the ad-tech industry as a whole. In particular, if the CJEU considers that IAB Europe cannot be a data controller, that practically means that the case is over since IAB was fined by the Belgian controller in its controller capacity.

A positive ruling to these questions will mean that not only IAB Europe but also other parties involved in the TCF (including Consent Management Platforms and vendors for example) are joint controllers, involving a number of additional responsibilities.

What does that mean for your business and how to get ready?

Regardless of whether the Court of Justice of the European Union agrees with the Belgian APD or not, it is unlikely that a decision will be taken before 2024 by the Market Court once it receives the answers from the CJEU.

The Market Court interim ruling does not include the suspension of the execution of the APD decision until a final ruling on the merit is rendered. 

In order to prepare for whatever comes next, we put together a comprehensive list of recommendations and best practices in a previous article, ranging from resurfacing your CMP notice to evaluating and limiting the number of vendors for which consent is collected.

To better understand the initial context surrounding the Belgian APD decision and its consequences, and to dive deeper into the recommendations we give our customers, revisit our blog post from last February on the topic. And to learn how Didomi can help, book a demo with one of our experts: