Series
Blogs
GDPR fine sends shockwaves across the adtech industry
GDPR fine sends shockwaves across the adtech industry
28 February 2022
Series
Blogs
28 February 2022
The Belgian Data Protection Authority’s decision on the Transparency and Consent Framework was made to “restore order to the online advertising industry”. If upheld on appeal the decision will affect the entire adtech ecosystem.
Belgium’s Data Protection Authority (“DPA”) found on 2 February 2022 that IAB Europe’s Transparency and Consent Framework (“TCF”), which is used across the adtech industry, violated the GDPR. The DPA found that IAB Europe was responsible for the TCF, and gave it two months to develop an action plan to bring the framework into compliance with the GDPR.
The TCF facilitates the management of users’ preferences for online personalised advertising and plays a key role in facilitating real-time bidding. Although the Belgian DPA’s decision focuses exclusively on the TCF and not the real-time bidding system itself, the decision will have widespread implications for the industry because of three key factors:
The Belgian DPA concluded that IAB Europe’s TCF violates numerous provisions of the GDPR on the following grounds:
1. Failure to properly obtain consent and absence of legitimate interest
The DPA found that IAB Europe did not have a legal basis for the registration of the consent signal, objections and users’ preferences. It said the consent of the data subjects obtained through CMPs was not legally valid, as the proposed processing purposes were not sufficiently clearly described and in some cases were misleading (the DPA flagged, among others, the absence of an overview of the categories of data collected, recipients so numerous that users needed a disproportionate amount of time to read this information, and the withdrawal of consent never being immediate).
The only alternative legal ground that could have been considered here (i.e. legitimate interests) likewise failed, because the TCF processing could not be reasonably expected by data subjects. The DPA also pointed out that no option was offered to users to completely oppose the processing of their preferences, as information (linked to users’ unique User ID through a cookie) was placed on devices regardless of which choice users made. Users were additionally not informed about the cookie placement.
More specifically, the Belgian DPA considered that no balanced legitimate interest for the processing of the data existed in the context of the TCF, as:
The Belgian DPA also considered that IAB Europe did not dispose of a legal basis for the collection and dissemination of personal data in the context of real-time bidding.
2. Lack of transparency
The Belgian DPA decided that the information provided under the TCF, in its current form, did not comply with the GDPR’s transparency obligations.
The DPA pointed to the fact that the interface offered to users did not allow, among other things, the processing purposes associated with the authorisation of a particular vendor, or which adtech vendors would process their data for a specific purpose, to be identified in a simple and clear manner. The large number of third parties that would potentially receive and process users’ personal data was not found to be compatible with the condition of a sufficiently informed consent, nor with the broader transparency duty set out in the GDPR.
The Belgian DPA also found that the TCF violated a raft of other GDPR provisions, including that:
The €250,000 fine imposed by the Belgian DPA is well below the EUR 20,000,000 or 4% of global turnover that IAB Europe could theoretically have been fined.
However, IAB Europe was given just two months to submit an action plan to render the TCF compliant with the GDPR’s lawfulness, fairness and transparency, integrity and security requirements, and to prepare a record of processing activities, carry out a data protection impact assessment and designate a data protection officer. Once the DPA validates the plan, IAB Europe will have six months to implement it. A failure to meet these deadlines would result in a €5,000 daily penalty.
But the Belgian DPA itself has queried whether a solution can actually be found, noting that “[i]t is uncertain whether, in view of its current architecture and support of the OpenRTB protocol, the TCF can be reconciled with the GDPR”.
IAB Europe plans to appeal against the Belgian DPA’s decision in the meantime.
This article was first published in Global Data Review, available here.