The Belgian Data Protection Authority ('Belgian DPA') announced, on 7 September 2022, that the Market Court had issued an interim ruling, but referred preliminary questions to the Court of Justice of the European Union ('CJEU'), regarding the appeal that the Interactive Advertising Bureau ('IAB') Europe had filed against the Belgian DPA's decision on its Transparency and Consent Framework ('IAB TCF'), whereby it imposed a €250,000 fine against IAB Europe for violations of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). 

Interim ruling

Within the interim ruling, the Market Court dismissed various procedural grounds of appeal from IAB Europe as unfounded, including claims that:

• several complaints are inadmissible;
• the Belgian DPA's inspection report violates IAB Europe's rights of defence and/or in itself would be insufficiently reasoned; and
• the Belgian DPA's inspection report was incomplete and biased.

Simultaneously, the Market Court determined some grounds of appeal to be well-founded in part, including the seventh and eighth grounds of appeal that:

• the way in which the arbitration had dealt with the proceedings is contrary to its duties and powers as data protection authority, violating the appellant's rights of defence and disregarding the principle of due care as a principle of sound administration in conjunction with the duty to state reasons set out in the eighth ground of appeal; and
• that the contested decision is not adequately reasoned.

Furthermore, the Market Court concluded that it could not determine whether IAB Europe should be qualified as a data controller for the processing of personal data within the TCF, in particular the TC String. 

Preliminary questions

Accordingly, the Market Court decided to refer preliminary questions to the CJEU. Specifically, the questions principally concern IAB Europe's status as a data controller or joint controller, and whether the TC String, whether or not in combination with an IP address, can be considered personal data, among other things. 

Belgian DPA response

Furthermore, the Belgian DPA noted that it must further analyse the ruling before providing comment, but that it further clarifies key concepts of the GDPR such as the definition of the concept of data controller, and its applicability to framework designers.

IAB Europe response

In response, IAB Europe published, on 7 September 2022, a press release acknowledging the interim ruling, welcoming the decision to seek guidance from the CJEU, and noting that the referral to the CJEU means that a final judgment by the Market Court is unlikely until 2023 or even 2024.

You can read the Belgian DPA press release here, the interim ruling here, IAB Europe's statement here, and the Irish Council for Civil Liberties ('ICCL') press release here.

UPDATE (12 January 2023)

Belgian DPA approves IAB Europe action plan

The Belgian DPA announced, on 11 January 2023, that it had approved IAB Europe's action plan for compliance and that it has a maximum of six months to implement the proposed measures.

You can read the full story here.