07 Mar
2024

IAB EUROPE case: The CJEU answers the questions referred for a preliminary ruling

The Court of Justice of the European Union (CJEU) published today its ruling in the case opposing the Belgian Data Protection Authority and IAB EUROPE.

In its decision, the Court holds, as argued by the Belgian DPA in its decision 21/2022, that a structured character string capturing internet users' preferences such as IAB EUROPE's TC string can indeed be considered as personal data, and that IAB EUROPE can be qualified as a (joint) controller of users' preferences for online advertising.

IAB EUROPE case - Context

On 2 February 2022, the Belgian DPA published a decision concerning IAB EUROPE's TCF (Transparency and Consent Framework), a widespread mechanism that facilitates the management of users’ preferences for online personalised advertising, and which plays a central role in what is known as Real Time Bidding (RTB). RTB is an ecosystem that enables the sending of personalised ads.

The Belgian DPA fined the company €250,000 and gave it two months to submit an action plan to bring its activities into compliance. The decision was endorsed by all the concerned data protection authorities in the EU, after applying the one-stop-shop mechanism.

IAB EUROPE had appealed this decision before the Market Court (part of the Court of Appeal). Before ruling on the case, the Market Court decided to refer two preliminary questions to the CJEU.

The questions concerned whether a "standard-setting sectoral organisation" such as IAB EUROPE was a (joint) controller, and whether a string of numeric characters reflecting user preferences (such as the "TC String") could be considered as personal data. The exact questions can be read more in detail on the CJEU website.

Reiterating its position, the Belgian DPA argued before the CJEU that the TC String constitutes personal data, in particular because its purpose is to link advertising preferences to a specific individual. In its oral argument, the Belgian DPA also considered that IAB EUROPE was a (joint) controller in the context of the TCF, as this sectoral organisation determines the purposes and means of the processing. IAB EUROPE plays a key role in the ecosystem of personalised advertising online.

The CJEU has provided answers to these questions today.

Ruling of the CJEU

On the question of whether the TC String should be considered as personal data, the CJEU states in its judgment that a structured character string capturing a user's preferences constitutes personal data - i.e. data relating to an identified or identifiable user - with regard to a sectoral organisation standardising and prescribing the method for generating a character string, even if this sectoral organisation does not have access to this character string.

On the question of whether a sectoral organisation which standardises and prescribes the method for capturing and transmitting user preferences can be considered a controller in respect of the processing carried out in accordance with this method, the CJEU ruled that such a sectoral organisation can be qualified as controller for the processing of preferences given that this organisation appears to exert influence over data processing operations when the consent preferences of users are recorded in a TC String, and to determine, jointly with its members, both the purposes of those operations and the means behind them.

The Belgian DPA must now analyse the ruling more in detail in order to better understand its potential impact on the IAB EUROPE case.

Hielke Hijmans, Chairman of the Belgian DPA's Litigation Chamber: "We welcome the interpretation of the CJEU, which confirms our view that a structured string of characters capturing users' preferences is personal data, and that a sectoral standard-setting organisation such as IAB EUROPE is the (joint) controller of this personal data. By clarifying key concepts of the GDPR in this way, this ruling will have a positive impact on all data subjects in the European Union. The procedure before the Belgian Market Court may now resume.”

The judgment is available here.

A press release by the CJEU is available here.

Next step

On the basis of the answers provided to its preliminary questions by the CJEU, the Market Court will now have to rule on the appeal lodged by the company IAB EUROPE, as well as by the complainants in the case.

Timeline of the IAB EUROPE case

2022

• On 2 February 2022, the Litigation Chamber of the Belgian DPA published its decision 21/2022 concerning IAB Europe, in which the Litigation Chamber imposes several sanctions including an action plan for compliance
• IAB EUROPE appeals the decision
• On 7 September 2022, the Market Court refers several questions to the CJEU for preliminary ruling

2023

• On 11 January 2023, the Litigation Chamber approves IAB EUROPE's action plan
• IAB EUROPE and the complainants in the IAB EUROPE case appeal the decision of the Litigation Chamber to approve IAB EUROPE's action plan
• On 21 September  2023, the hearing before the CJEU takes place

7 March 2024

• The CJEU rules on the case in its judgment C-604/22

Interesting links

Judgment case C-604/22 CJEU Press release case C-604/22 CJEU Decision on the merits 21/2022 The BE DPA to restore order to the online advertising industry: IAB Europe held responsible for a mechanism that infringes the GDPR IAB Europe case: The Market Court refers preliminary questions to the Court of Justice of the EU