On February 2, 2022, the Litigation Chamber of the Belgian Data Protection Authority (the “Belgian DPA”) imposed a €250,000 fine against the Interactive Advertising Bureau Europe (“IAB Europe”) for several alleged infringements of the EU General Data Protection Regulation (the “GDPR”), following an investigation into IAB Europe Transparency and Consent Framework (“TCF”).

Background

The Belgian DPA started an investigation into IAB Europe after receiving several complaints since 2019 regarding the TCF.

The TCF is a GDPR consent solution developed by IAB Europe that has become a widely used approach to collecting and managing consent for targeted advertising cookies in the EU. The TCF was designed to accommodate the use of cookies in connection with the OpenRTB protocol, which is a common protocol used by companies for “Real-Time Bidding.” in programmatic advertising. The OpenRTB protocol enables advertisers to bid in real time on ad inventory contained on a publisher’s property (e.g., website or app), in order to deliver targeted advertising tailored to the profile of the website or app user. Under the TCF, a consent management tool is presented to a user on their first visit to a website or app to obtain the user’s consent to the collection and sharing of their data for targeted advertising purposes. The consent management tool enables the user to object to certain processing activities based on the ad tech vendors’ legitimate interests. The TCF registers the user’s preferences through the consent management tool by creating a digital signal that allows the linking of a user’s preferences with the user’s IP address, therefore making users identifiable for targeted advertising purposes.

The Belgian DPA’s Decision

In the context of the Belgian DPA’s investigation, IAB Europe asserted that it does not act as a data controller for its collection of users’ consents, objections and preferences through the TCF, as the ad tech vendors following the OpenRTB protocol (the “participating organizations”) determine the purposes of processing, without IAB Europe’s intervention. The Belgian DPA rejected this argument and found that IAB Europe acts as a data controller with respect to the TCF and therefore can be held responsible for violations of the GDPR.

Key points from the Belgian DPA’s decisions are summarized below:

• Lawfulness. The Belgian DPA found that IAB Europe does not have a legal basis for the processing of personal data through the TCF. IAB Europe also failed to demonstrate that it has an adequate legal basis for the sharing and subsequent processing of the data by the participating organizations. Particularly, the Belgian DPA held that the participating organizations’ legitimate interests in conducting targeted advertising and user profiling are outweighed by the website and app users’ interests in the protection of their fundamental rights and freedoms.

• Transparency. The Belgian DPA also held that IAB Europe does not meet the GDPR’s transparency standards because the information IAB Europe provides through the consent management tool is too generic and vague, particularly in light of the complexity of the TCF.

• Accountability, Security, and Data Protection by Design and By Default. According to the Belgian DPA, IAB Europe failed to demonstrate that appropriate technical and organizational measures are in place to ensure the effective exercise of website and app users’ rights, and to monitor the validity and integrity of users’ choices. The Belgian DPA’s investigation also revealed that IAB Europe allegedly failed to maintain a register of its data processing activities (in line with Article 30 of the GDPR), to appoint a data protection officer and to conduct a data protection impact assessment with respect to the TCF.

Sanctions

The Belgian DPA imposed an administrative fine of €250,000 on IAB Europe. In doing so, the Belgian DPA considered that the TCF may result in large groups of individuals losing control over their personal data. In addition to a monetary fine, the Belgian DPA required IAB Europe to, among other things:

• Establish a valid legal basis for the processing and sharing of website and app users’ preferences in the context of the TCF and ensure appropriate transparency;

• Prohibit participating organizations from relying on the legitimate interests legal basis for their data processing activities;

• Permanently delete personal data already processed in the context of the TCF from all its systems and its processors’ systems; and

• Audit participating organizations to ensure they comply with the GDPR.

IAB Europe has two months to present the Belgian DPA with an action plan to implement these corrective measures.

One Stop Shop

In November 2021, the Belgian DPA, acting as the lead supervisory authority for this investigation, provided its draft decision to the other 27 concerned EU supervisory authorities, as required by the GDPR cooperation mechanism (Article 60 of the GDPR). As part of this process, two objections were raised, and the Belgian DPA incorporated those objections in its final decision of February 2, 2022, which was approved by all concerned authorities.

The Belgian DPA’s decision can be appealed within 30 days after its notification to the Market Court.

Read the Belgian DPA’s decision and press release.

Read IAB Europe’s press release following the Belgian DPA decision.