Belgium: Belgian DPA imposes €250,000 fine on IAB Europe for TCF violations of GDPR
The Belgian Data Protection Authority ('Belgian DPA') published, on 2 February 2021, its decision in Case No. DOS-2019-01377, as issued on the same date, in which it imposed a fine of €250,000 on Interactive Advertising Bureau Europe ('IAB Europe') pursuant to Article 101 of the Law of 3 December 2017 on the Creation of the DPA ('LCA') and further ordered IAB Europe to comply with Articles 5(1)(a), 5(1)(f), 6, 12, 14, 24, 25, 30, 32, 25, 37, 38, and 39 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following an investigation into the Transparency and Consent Framework ('TCF').
Background to the case
In particular, the Belgian DPA noted that it had received, since 2019, a series of complaints targeting IAB Europe and challenging the conformity of the IAB TCF with the GDPR.
Findings of the Belgian DPA
Following an investigation, the Litigation Chamber of the Belgian DPA determined that IAB Europe acts as a data controller for the registration of individual users' consent signal, objections, and preferences by means of the Transparency and Consent String, linked to an identified user. Consequently, the Belgian DPA found that IAB Europe can be held responsible for potential violations of the GDPR.
Most notably, the Belgian DPA found that IAB Europe had:
- failed to establish a legal basis for the processing of the TC String, and offered inadequate legal grounds for the subsequent processing by adtech vendors;
- provided generic and vague information to users through the consent management platform interface;
- failed to implement organisational and technical measures in accordance with the principle of Data Protection by Design and Data Protection by Default;
- failed to keep a register of processing activities;
- failed to appoint a data protection officer; and
- failed to conduct a Data Protection Impact Assessment.
Consequently, the Belgian DPA imposed the aforementioned fine and compliance order, as part of which IAB Europe must present an action plan to bring its activities into compliance within two months and complete compliance within a maximum period of six months.
IAB Europe may now appeal the decision through the Market Court.
In addition, IAB Europe responded, on 2 February 2021, with a statement acknowledging the Belgian DPA's decision. More specifically, IAB Europe stated that the decision contains no prohibition of the TCF and further rejected the finding that IAB Europe is a data controller in the context of the TCF.
UPDATE (14 February 2022)
IAB Europe confirms intention to appeal decision to Belgian Market Court
IAB Europe confirmed, on 11 February 2022, that it will appeal the Belgian DPA's decision on the IAB TCF to the Belgian Market Court. In particular, IAB Europe disputed the Belgian DPA's finding that IAB Europe acts as a joint controller for profiling and other data processing carried out by TCF vendors in the context of OpenRTB. Furthermore, IAB Europe recognised calls for advertisers to cease using TCF and OpenRTB, but found such conclusions to be unfounded on the basis that no advertisers are named parties in the Belgian DPA's decision and that the Belgian DPA had not ordered IAB Europe to discontinue use of the TCF pending its submission of a response plan.
You can read the press release here.
UPDATE (12 April 2022)
IAB Europe confirms submission of action plan
IAB Europe confirmed, on 1 April 2022, that it had submitted the action plan required by the Belgian DPA's decision on the IAB TCF. In particular, IAB Europe noted that the submission of the action plan marks a key milestone in the two-phase remediation period foreseen in the decision and should enable a version of the TCF, with a broader compliance functionality, to be rolled out over a six-month period under the supervision of the Belgian DPA.
In addition, IAB Europe stated that the action plan outlines how IAB Europe, in its capacity as the managing organisation of the TCF, will deliver on the formal orders laid down in the decision and reflects in-depth discussions amongst IAB Europe member companies that implement the TCF and convene in the existing TCF working groups and other instances, as well as the IAB Tech Lab. However, IAB Europe outlined that the submission of the action plan is without prejudice to IAB Europe's appeal of the decision to the Belgian Market Court. Lastly, IAB Europe stated that once the action plan has been reviewed and validated by the Belgian DPA and concerned supervisory authorities, IAB Europe will have six months to implement it.
You can read the press release here.