IAB Europe has been found in breach of GDPR. Here’s what it means.
Published: 03 Feb 2022
A new ruling has found IAB Europe in breach of various articles within GDPR, specifically regarding the lawfulness of processing of their Transparency and Consent Framework (TCF). A €250,000 sanction has been issued to IAB Europe, as well as a series of demands. As a result, advertisers and other members of the ecosystem will have to delete all historic data gathered using this framework.
What are the main factors behind the IAB Europe GDPR ruling?
GDPR
- Provides Rights for consumers (Data Subjects) and places the obligation of ensuring those rights are upheld upon Data Controllers
- Is a principles based legislation that focuses on the expected Outcomes experienced by Consumers rather than prescribing details / rules, on what to do
- Leaves the controls, measures, and procedures used to follow GDPR is up to each organisation (the Data Controller)
The IAB Europe argue they are not a Data Controller; The Data Protection Authority disagree, and as a result they find that the IAB Europe are in breach of various obligations under GDPR.
GDPR defines a Data Controller as ‘the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.’
By contrast, GRPR defines a Data Processor as ‘a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.’
Players within the ecosystem operate as a Data Controller and/or as a Data Processor. However, the specific roles are similarly opaque:
- An organisation can operate as a Processor for one purpose, whilst acting as a Controller in regard to processing personal data for another purpose.
- Whilst the responsibility of the Controller may also be assigned on the basis of the contractual provision, these are not always decisive and the basis of the actual control (i.e. determining the means and purpose) should be used.
- There can be multiple Controllers responsible for a set of data.
Impact upon other companies within the digital ecosystem
IAB Europe have been found in breach of various articles specifically regarding the Lawfulness of processing. This has an impact upon the personal data processed historically: "It is the responsibility of the CMPs and the publishers who implement the TCF, to take the appropriate measures ensuring that personal data that has been collected in breach of Articles 5 and 6 GDPR is no longer processed and removed accordingly."
The original complaint originated from the Irish council of civil liberties (ICCL) and claims that "All data collected through the TCF must now be deleted by the more than 1,000 companies that pay IAB Europe to use the TCF. This includes Google’s, Amazon’s and Microsoft’s online advertising businesses."
A must read
A valuable insight to help you better understand the implications of the APD ruling on IAB’s TCF, what you need to know, immediate impacts and future considerations - https://www.twobirds.com/en/news/articles/2022/uk/apd-v-iab-tcf-changes-ahead
FURTHER INFO / References
· Ruling in English
- IAB Europe
- TCF FAQ’s - https://www.iabuk.com/news-article/iab-europe-publishes-faqs-apds-tcf-ruling
- Statement - https://iabeurope.eu/all-news/apd-ruling-clears-way-for-work-on-developing-tcf-into-a-formal-gdpr-code-of-conduct-iab-europe-statement-on-the-apd-decision-announced-today/
- Response - APD Ruling Clears Way For Work on Developing TCF into a Formal GDPR Code of Conduct: IAB Europe Statement on the APD Decision Announced Today – IAB Europe
- TCF Guidelines - https://iabeurope.eu/wp-content/uploads/2019/08/TCF-Fact-Sheet_General.pdf
- ICCL Irish Council of Liberties
Categories: Industry News