CJEU ruling clarifies limited role of IAB Europe in TCF

Update, November 2024: The Belgian Market Court's hearing is now expected in January 2025

IAB Europe has acknowledged the ruling handed down today by the CJEU in connection with its appeal of the Belgian Data Protection Authority's (APD) decision against IAB Europe and the TCF in February 2022. In September 2022, the Belgian Market Court’s interim judgement referred questions to the CJEU for a preliminary ruling on the basis that the APD's decision was insufficiently substantiated and failed to meet the relevant standard for proper investigation and fact-finding.

In relation to the CJEU's latest ruling, IAB Europe states that it “welcomes the CJEU ruling that provides well-needed clarity over the concepts of personal data and (joint) controllership, which will allow a serene completion of the remaining legal proceedings.”

In particular, the judgement of the Court establishes:

• TC Strings (digital signals containing user preferences) constitute personal data, even from the perspective of IAB Europe, when they can be linked with reasonable means to an identifier such as for instance the IP address of the device of the user and IAB Europe can have access to such data
   
• IAB Europe can be viewed as a joint controller, together with TCF participants, in relation to the creation and use of TC Strings by publishers and vendors. This is on the basis that the TCF provides specifications for its processing, if IAB Europe actually influences the processing (purposes and means) for its own reasons
   
• IAB Europe should not necessarily be viewed as a joint controller, together with TCF participants, in relation to the subsequent data processing performed in pursuit of the TCF purposes - such as digital advertising, audience measurement, or content personalisation - since IAB Europe has no influence on such processing. The CJEU conclusion on the latter is particularly important, as the APD’s erroneous controllership qualification of IAB Europe over such processing served as a basis for the authority’s assessments of the validity of legal bases established through the TCF and corresponding sanctions

The Belgian Market Court will now resume its examination of IAB Europe’s substantive arguments in line with the answers provided by the CJEU. Pending the conclusion of the proceedings before the Market Court which can take several months, the suspension of the execution of the APD decision (i.e. the implementation of IAB Europe’s action plan following its validation) continues to apply.

IAB Europe will be posting a more in-depth commentary of the ruling and of its consequences shortly. Although it was adopted specifically in the context of the TCF-related dispute before the APD, the findings of the CJEU are important for all organisations with digital activities.

An updated FAQ regarding the APD decision can be found on IAB Europe’s website, here.