The European arm of the Interactive Advertising Bureau (IAB) released a statement last week acknowledging it expects to be found in violation of the EU’s General Data Protection Regulation (GDPR) regarding its Transparency and Consent Framework (TCF).
IAB Europe said a draft ruling by the Belgian Data Protection Authority (APD) “will apparently identify infringements of the GDPR by IAB Europe” that it expects to be capable of remedying within six months of a final ruling. Such a determination might not come for months, as the APD is expected to share its draft decision with other EU data protection authorities under the cooperation procedures of the GDPR.
Should there be notable disagreement among the supervisory authorities, the matter might be referred to the European Data Protection Board for a binding decision, similar to Ireland’s cases against Twitter and WhatsApp.
IAB Europe did not note any potential fine amounts contained in the APD’s draft ruling.
The TCF is designed “to help all parties in the digital advertising chain ensure that they comply with the EU’s GDPR and ePrivacy Directive when processing personal data or accessing and/or storing information on a user’s device, such as cookies, advertising identifiers, device identifiers, and other tracking technologies,” IAB Europe stated on its website.
Yet, the APD last year found the framework ran afoul of the GDPR’s principles of transparency, fairness, and accountability. IAB Europe at the time responded that it disagreed with the APD’s assessment.
“We find it regrettable that a standard whose requirements reflect an interpretation of the law that errs on the side of consumer protection and aligns with multiple DPA guidance materials across the EU … should be the focus of an enforcement action, rather than an opportunity for a constructive, good-faith dialogue on how the TCF can be improved in ways that better align with the APD’s vision and with consumer and industry needs,” IAB Europe stated.
The APD’s draft ruling is expected to find IAB Europe to be a data controller for the TCF’s digital signals that “capture data subjects’ choices about the processing of their personal data for digital advertising, content, and measurement.” The company stated it believes otherwise and, therefore, has “naturally not fulfilled certain obligations that accrue to data controllers under the regulation.”
“The draft ruling will require IAB Europe to work with the APD to ensure that these obligations are met going forward,” IAB Europe stated.
Many companies widely rely upon the TCF, with Google among its adopters.
No comments yet