Update on the Belgian Data Protection Authority’s investigation of IAB Europe

The Belgian data protection authority (APD) is expected to issue a draft ruling regarding its ongoing investigation of IAB Europe and its role in the Transparency & Consent Framework (TCF), in response to complaints it received. We expect the ruling to state that the APD considers ‘TC Strings’ to be personal data and IAB Europe, as manager of the TCF, to be a data controller. 

I am aware that this ruling may raise questions among some of our members. I want to reassure you that the TCF is a valid and compliant cross-industry resource and, if your business is using it, no action is needed from you as a result of the APD’s current ruling. 

The draft ruling will apply specifically to how IAB Europe manages the TCF, concluding for the first time that it is a data controller and that it must now work with the APD to meet additional requirements as a result. However, it does not apply to the TCF as a whole and it’s important to note that the framework has been conceptually approved by the data protection authority. 

Finally, while the APD’s decision will not directly apply to the UK post-Brexit, it’s crucial that the TCF continues to function seamlessly across borders. We’ll be working closely with IAB Europe to understand and communicate to our members any future changes to IAB Europe’s management of the TCF, as they are agreed with the APD.