Belgian Court Partially Overturns APD Decision on IAB Europe’s GDPR Joint Controllership
The Belgian Market Court, part of the Brussels Court of Appeal, has annulled the February 2022 decision made by the Belgian Data Protection Authority (APD) regarding IAB Europe and its Transparency & Consent Framework (TCF) version 2.0. This ruling follows an earlier interim decision from September 2022, which identified procedural errors, including the APD’s failure to properly explain why it considered TC Strings as personal data.
The Market Court rejected the APD’s position that IAB Europe acts as a joint data controller alongside TCF participants for their own processing activities, such as digital advertising. This aligns with the Court of Justice of the European Union’s (CJEU) judgment from March 7, 2024. However, the Court upheld the APD’s view that IAB Europe is a joint controller only concerning the creation and use of TC Strings by publishers and vendors.
IAB Europe has already proposed changes to the TCF to reflect this limited joint controllership as part of an action plan approved by the APD in 2023. Although the execution of this plan is currently paused, these adjustments can be implemented promptly to comply with the Market Court’s ruling. IAB Europe has committed to keeping the market informed about the case and any developments related to the Framework.
Townsend Feehan, CEO of IAB Europe, highlighted that the ruling supports the CJEU’s stance that IAB Europe should not be considered a joint controller for data processing activities beyond TC Strings. He expressed hope that the decision will encourage regulators to engage in constructive discussions that consider technical and practical realities, enabling the development of effective improvements to the TCF for the benefit of users and participants.
