IAB Europe submits action plan in APD case

In its statement, IAB Europe explains: “The submission of the action plan marks a key milestone in the two-phase remediation period foreseen in the decision, and should enable a version of the TCF with a broader compliance functionality to be rolled out over a 6-month period under the supervision of the APD.

“The action plan outlines how IAB Europe, in its capacity as Managing Organisation of the TCF, will deliver on the formal orders laid down in the decision and reflects in-depth discussions amongst IAB Europe member companies that implement the TCF and convene in the existing TCF working groups and other instances, as well as IAB Tech Lab. 

“These instances are multi-stakeholder, bringing together publishers, ad tech intermediaries, agencies, and CMPs (Consent Management Platforms).  The actions in the plan were approved by the TCF Steering Group on 23 March (information about TCF governance is publicly available and may be consulted here). Each of the steps described in the action plan is the result of a careful assessment of which measures appear best-suited to meeting the APD’s interpretation of the GDPR and the obligations the decision creates for IAB Europe. 

“The submission of the action plan is without prejudice to IAB Europe’s appeal of the decision to the Belgian Market Court.  The appeal, as previously announced, contests a number of findings in the decision, in particular the findings that IAB Europe acts as a data controller of the TC String (the digital signals created to capture data subjects’ choices on how their personal data can be processed) and as a joint controller for the dissemination of TC Strings and other data processing done by TCF participants under the OpenRTB protocol.     

“Notwithstanding the appeal to the Market Court, IAB Europe welcomes the opportunity of the forthcoming dialogue with the APD and concerned supervisory authorities on the action plan to solicit their guidance on how best to deliver extended functionality to the TCF. IAB Europe has long aspired to submit the TCF for approval as a transnational GDPR Code of Conduct, and the action plan being submitted today is an important step in this direction.

“Once the action plan has been reviewed and validated by the APD and concerned supervisory authorities, IAB Europe will have six months to implement it.”

For more information on the APD decision on IAB Europe and the TCF, please find IAB Europe’s latest FAQ document here.