Decision of the Belgian DPA Our remarks The Belgian DPA imposed a fine of 250,000 EUR for the • According to the Belgian DPA, the processing of a following violations: TC String in combination with a user’s IP address • Processing user preferences in the form of TC amounts to personal data within the meaning of Strings without legal basis (GDPR, Articles 5(1)(a) GDPR. As the purpose of TC Strings is to single out and 6). individuals and capture their personal preferences, the DPA argues, it can be assumed that the data • Failing to sufficiently inform data subjects and thus subject will likely be identified, although indirectly. comply with transparency requirements (GDPR, However, this interpretation of the notion of Articles 12, 13 and 14). personal data has been criticized by IAB Europe for • Failing to ensure the security of the processing being overly broad from a consumer protection (GDPR, Articles 24, 25, 5(1)(f) and 32). point of view and has since been referred to the • Failing to keep a record of the relevant processing Court of Justice of the European Union by the activities (GDPR, Article 30). Market Court. The question is currently unanswered. • Failing to perform a data protection impact • The case will likely have far-reaching implications assessment (GDPR, Article 35). for the status of standard setting organizations. • Failing to appoint a data protection officer (GDPR, Although industry standards are highly impactful Article 37). in establishing best practices within a particular sector, assigning these organizations the The Belgian Data Protection Authority furthermore responsibilities of (joint) controllers based on codes imposed an obligation on IAB Europe to undertake of conduct may prove a drastic step. Following the several corrective measures. IAB Europe should develop reasoning of the Court of Justice of the European an action plan to include: Union in the coming months will hopefully provide • A valid legal basis for processing and sharing user much anticipated clarity on this issue. preferences within the TCF. • Auditing the GDPR compliance of all organizations participating in the TCF. Decision of the Market Court of Appeals In an interim ruling of 7 September 2022, the Market Court found that the decision of the Belgian DPA was insufficiently substantiated while referring two questions to the Court of Justice of the European Union. These questions concern the interpretation of data controllership as well as the legal status of TC Strings under GDPR. Once answered, the Market Court will rule on the substantive issues raised in IAB Europe’s appeal of the Belgian DPA’s decision. A decision is expected in 2024. 73