What’s happening with IAB Europe, the TCF & the APD?

IAB Europe has announced that the Belgian Data Protection Authority (the APD) is proceeding to examine the action plan IAB Europe submitted to it in April 2022, despite an interim ruling from the Belgian Market Court that declared the APD’s decision illegal. So what’s actually happened to date? And what does it mean for IAB UK members? Here we give a topline overview and share where you can find out more information. 

What’s happened so far? 

In February 2022, the APD issued a ruling against IAB Europe, which concluded its investigation of IAB Europe and the Transparency & Consent Framework. It ruled that ‘TC Strings’ (which are fundamental to how the TCF operates) are personal data and therefore that IAB Europe, as the operator of the TCF, is a data controller. IAB Europe had not considered itself to be a data controller, in line with previous guidance from data protection authorities, and so hadn’t met certain obligations (that apply to data controllers) under GDPR. You can find out more about this under question one here. 

In short, the APD’s ruling resulted in IAB Europe’s role (in respect of the TCF) changing, and the APD required IAB Europe to submit an action plan within  two months of the decision, detailing the changes it would make to the TCF, and to meet its GDPR obligations, in line with the APD’s findings. The APD would then evaluate the action plan and, once validated, IAB Europe would have a further six months to implement it.

IAB Europe rejects the ruling that it is a data controller and, in March 2022, it appealed the APD’s ruling to the Belgian Market Court. In tandem with this, and as required by the APD, it developed an action plan that it submitted to the APD on 1 April 2022. The appeal is in progress and, in September 2022, the Belgian Market Court handed down an interim ruling that stated the APD’s decision was illegal on procedural grounds because of the APD’s lack of due care. It also referred some fundamental questions about the interpretation of the GDPR that the APD’s decision relies on  - and are relevant to IAB Europe’s action plan - to the Court of Justice of the European Union (CJEU). 

The APD had confirmed that it would not make a decision on IAB Europe’s action plan (i.e. whether or not to validate it) until after the appeal hearing was due to take place, and no earlier than 1 September. Now that the hearing has happened, the APD has notified IAB Europe that it considers its decision remains applicable, and that it will be proceeding to review the action plan. This is despite the Belgian Market Court’s interim ruling and the pending questions with the CJEU. 

Why does this matter? 

IAB Europe has said that it welcomes the opportunity to enter into a dialogue with the APD and other supervisory bodies regarding the action plan and its continued work to improve the TCF. However, it does not believe that the APD can require the action plan to be put in motion because the appeals process is still ongoing. Given that the Belgian Market Court’s interim ruling is that the APD’s decision is illegal, and that there are currently fundamental outstanding questions that the CJEU has been asked to rule on, IAB Europe firmly believes that the APD cannot continue to enforce its decision. 

As IAB Europe states in its press release, it “reserves the right to engage in any form of available legal action against the APD should it attempt to enforce its illegal decision and preempt responses from the CJEU on the central issues that have been referred to it.” 

What else has IAB Europe said?

Townsend Feehan, CEO of IAB Europe, explains: “The questions that have been referred to the CJEU are foundational as they call into question whether an enforcement action should have been brought against IAB Europe in the first place. Pending the answers from the CJEU on the matter, we look forward to soliciting guidance from Data Protection Authorities to deliver extended functionality to the TCF.”

What does this mean for IAB UK members? 

At present, nothing changes. IAB Europe is still awaiting a final ruling from the Belgian Market Court, pending answers from the CJEU and this is likely to take some time. IAB UK members using the TCF can continue to do so. Back in March, we developed a set of FAQs specific to IAB UK members, which you can find here. The answers to questions 6-8 under ‘use of TCF by IAB UK members’ still stand, but please note that the ‘what’s happened so far’ information in this document hasn’t been updated to include the latest developments. If you have any questions, please don’t hesitate to get in touch with us. 

Where can you find out more? 

IAB Europe are regularly updating the FAQs on their site to keep pace with new announcements. You can find the latest version here.