[ad_1]
On 7 March 2024, the Court of Justice of the European Union (“CJEU”) handed down its judgment in the IAB Europe case (Case C-604/22). In this judgment, the CJEU assessed the role of the European Interactive Advertising Bureau (“IAB Europe”) in processing operations related to the Transparency and Consent Framework (“TCF”) and the CJEU regarding the concept of personal data based on: Further development of case law. EU General Data Protection Regulation (“GDPR”).
background
As explained in our previous blog, this case stems from a 2022 fine imposed by the Belgian DPA against IAB Europe as a result of an investigation into TCF.
TCF is a GDPR consent solution that is widely used in the EU as a mechanism to obtain and manage consent for the use of targeted advertising cookies. TCF was designed to accommodate the use of cookies in conjunction with the OpenRTB protocol, a common protocol used by companies for “real-time bidding” for programmatic advertising. The OpenRTB protocol allows advertisers to bid on ad inventory on publisher properties in real time (for example, website or app), to deliver targeted advertising tailored to the profile of users of the website or app. TCF provides consent management tools to users on their first visit to a website or app to obtain their consent to collect and share data for targeted advertising purposes. Consent management tools also allow users to object to certain processing activities based on an ad tech vendor’s legitimate interests. TCF registers your preferences through the consent management tool by creating a digital signal consisting of characters and combinations of characters (a “TCF string”).
Following an appeal to the Belgian Market Court, the Belgian Court asked the CJEU to clarify: (1) Whether TCF strings should be considered personal data. (2) IAB Europe’s role in processing operations related to the TCF;
CJEU decision
Regarding whether TCF strings should be considered personal data, the CJEU reiterated earlier Breyer case law, stating that “it is reasonably likely that a TCF string could be used to identify a person by the controller or another person.” “All possible means (such as identifying).” To determine whether a person is “identifiable”, consideration must be given to whether the person is “directly or indirectly a natural person”. In this case, the CJEU considered that, subject to further verification by the Belgian Market Court, IAB Europe appears to have reasonable means of being able to identify specific individuals through the TCF string. In particular, the CJEU states that a member of IAB Europe must provide, upon request by IAB Europe, all information that allows IAB Europe to identify users whose data is subject to a TCF string. I emphasized the facts.
Regarding IAB Europe’s role in the processing of personal data, the CJEU has determined that, subject to further verification carried out by the Belgian Market Court, IAB Europe may exercise influence over personal data processing operations related to the TCF and jointly: I thought to define it. its members, the purpose of such processing operations;
The CJEU also held that, subject to further verification by the Belgian Market Court, the means of processing operations are defined by the fact that the IAB Europe imposes certain rules and precise technical standards on Member States and Member States. Thought. Failure to comply may result in their suspension or exclusion.
However, the CJEU has determined that other entities such as data brokers and advertising platforms may consider IAB Europe as a joint controller for the subsequent processing of personal data carried out based on the preferences communicated through the TCF string. I refused as I should have.
next step
The case will now be referred back to the Belgian Market Court for a final decision based on CJEU guidance.
It is important to note that in 2023 the Belgian DPA approved the action plan presented by IAB Europe aimed at making the processing of personal data in the context of the TCF compliant with the GDPR. The implementation of this action plan is suspended pending a decision of the Belgian Market Court.
Read the CJEU decision.
[ad_2]
Source link
