Belgian DPA Finalizes Draft Deci...
Belgian DPA Finalizes Draft Decision in ...

Belgian DPA Finalizes Draft Decision in IAB Europe Case

Relevant European supervisory authorities notified and have 4 weeks to provide feedback to the draft decision.

clock3 Min Read

Featured Image

On November 25, 2021, the Belgian Data Protection Authority (DPA)  issued a press release concerning its draft decision in the case against Interactive Advertising Bureau Europe (IAB Europe) relating to their Transparency & Consent Framework (TCF). The DPA noted that its draft decision has now been sent to the concerned supervisory authorities pursuant to Article 60 of the GDPR for their feedback. The concerned supervisory authorities will have four weeks to respond.

Background to the Belgian DPA’s Draft Decision in the IAB Europe Case

In 2019, a series of complaints were filed with the Belgian DPA relating to the IAB TCF and whether it conforms with the GDPR. Subsequently, the Belgian DPA launched an investigation into IAB TCF.

In October 2020, statements on the findings of the Belgian DPA’s investigation were released by the Irish Council for Civil Liberties, which revealed that IAB TCF is in breach of the GDPR. According to the statements, the Belgian DPA concluded that the IAB TCF allowed companies to swap sensitive information about people without authorization. It was also stated that IAB TCF did not provide adequate controls for processing personal data that occurs in its OpenRTB system.

In November 2021, IAB Europe was notified that the Belgian DPA was close to finalizing its draft ruling, concluding the investigation of IAB Europe and its role in the TCF. In a press release, IAB Europe said that it had been informed that the draft ruling will identify infringements of the GDPR by IAB Europe, specifically relating to the use of TCF ‘TC Strings’, the digital signals created on websites to capture data subjects’ choices about the processing of their personal data for digital advertising, content, and measurement.

What’s Next for the IAB TCF Case?

The Belgian DPA has now finalized its draft decision in the IAB Europe case and has notified the relevant supervisory authorities of the decision. The concerned authorities now have four weeks to respond with feedback to the draft decision.

The Belgian DPA has outlined two possible scenarios for the future of the draft decision:

  • No relevant or reasoned objection to the draft decision is made therefore the decision can be finalized by the Belgian DPA; or
  • One or more of the authorities involved expresses a relevant and reasoned objection to the draft decision., Subsequently the Belgian DPA will either:
    • Submit a revised draft to the concerned authorities, taking this objection into account, or
    • The objection will not be considered reasoned or relevant and could therefore initiate the dispute resolution mechanism under Article 65 of the GDPR.

The Belgian DPA highlighted that it is unable able to comment further due to the confidential nature of the cooperation mechanism. Following the conclusion of the cooperation procedure, the final decision will be adopted by the Belgian DPA.

Further reading on the IAB Europe Case:

Follow OneTrust on LinkedInTwitter, or YouTube for updates on the latest regulatory developments.

You Might Also Be Interested In

JANUARY 13, 2023

Addressing UK app Code of Practice requirements with OneTrust

JANUARY 12, 2023

Ultimate guide to the EU CSRD ESG regulation for businesses

JANUARY 11, 2023

Continuous improvement: The leading indicator for successful compliance programs

JANUARY 10, 2023

Build trust, promote your program in the Third-Party Risk Exchange

JANUARY 9, 2023

Building trust in a zero trust world

JANUARY 9, 2023

Consent management by the numbers: 2022 DMA report summary

JANUARY 9, 2023

Navigating the California Privacy Rights Act as a HIPAA-compliant business

JANUARY 6, 2023

US state privacy bills on the horizon in 2023

Onetrust All Rights Reserved