The Market Court decided today to refer preliminary questions to the Court of Justice of the European Union in the appeal that IAB Europe had filed against decision 21/2022 of the Belgian Data Protection Authority (BE DPA).
This BE DPA decision established, among other things, that IAB Europe was responsible for the processing of personal data under the Transparency and Consent Framework (TCF), a widespread mechanism that facilitates the management of users’ preferences for online personalised advertising. As such, the BE DPA had found that IAB Europe could be held responsible for violations of the GDPR. It also imposed an administrative fine of EUR 250,000 to the company.
IAB Europe had appealed this decision before the Market Court (part of the Court of Appeal). Before ruling on the case, the Market Court decided to refer a series of preliminary questions to the Court of Justice of the European Union.
The questions concern IAB Europe’s status as a (joint) controller, and whether the “TC String” (a string of numeric characters reflecting users’ preferences) can be considered personal data.
The BE DPA will now have to further analyse the ruling before being able to express itself in more detail on its content, but it is already pleased with this decision, which will further clarify key concepts of the GDPR such as the definition of the concept of data controller, and its applicability to framework designers.
Read more at dataprotectionauthority.be
