Hof van Beroep - 2022/AR/292
From GDPRhub
| Hof van Beroep - 2022/AR/292 | |
|---|---|
 | |
| Court: | Court of Appeal of Brussels (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(1) GDPR Article 4(2) GDPR Article 4(7) GDPR Article 5(1)(a) GDPR Article 5(1)(f) GDPR Article 6 GDPR Article 13 GDPR Article 14 GDPR Article 24 GDPR Article 25 GDPR Article 30 GDPR Article 32 GDPR Article 35 GDPR Article 37 GDPR |
| Decided: | 14.05.2025 |
| Published: | |
| Parties: | IAB Europe |
| National Case Number/Name: | 2022/AR/292 |
| European Case Law Identifier: | |
| Appeal from: | APD/GBA (Belgium) 21/2022 |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in Dutch) |
| Initial Contributor: | cci |
A court upheld a €250,000 fine against IAB Europe for several GDPR violations related to its widely used Transparency and Consent Framework. The court held that IAB Europe was a joint controller for the TC strings that record website visitors' consent.
English Summary
Facts
IAB Europe (“IAB”, short of Interactive Advertising Bureau) is an association of undertakings active in the field of digital advertising such as publishers, ecommerce and marketing companies and intermediaries, including major international players such as Microsoft and Google. IAB is established in Belgium and operates on a European level.
IAB developed the “Transparency & Consent Framework” (“TCF”). The purpose of the TCF is to make the processing of personal data for online advertising compliant with data protection requirements. To this end, the TCF provides a set of technical standards and rules (in the form of contractual obligations) for companies in the sector. In particular, the TCF specifies how publishers, advertisers, and intermediaries should use the OpenRTB protocol, a widely used Real Time Bidding (“RTB”) system.
RTB consists in the instant and automated online auction of users profiles for the purpose of selling and purchasing advertising space online. When an internet user visits a webpage where advertising space is available, the server sends the user’s data to a platform where advertisers automatically and instantly place bids. Advertisers place their bids based on some characteristics of individual users visiting the page (such as their location, marketing profiles, and browsing history). The bid winner displays their customer's advertising in that specific advertising space. The whole process involves a mass exchange of personal data.
For this operation to be possible, users are (in principle) asked to express their advertising preferences when they first visit a publisher’s website. These preferences are collected by websites (more specifically, by each website's Consent Management Platform) and stored in a string called Transparency and Consent string (‘TC string’). The TC string is subsequently shared with advertisers and data brokers, in order to inform them of the user's preferences.
At the same time, the CMP writes a cookie called euconsent-v2 on the user’s device. In combination with the TC string, the euconsent-v2 cookie can reveal the user’s IP address.
In 2019 a number of complainants, including several non-profits, filed complaints with different DPAs against the TCF.
The DPA decision
The Belgian DPA, as lead supervisory authority, ruled that IAB was acting as a joint controller (along with the TCF participants) in relation to the TC string. The DPA also considered that this processing influenced the OpenRTB protocol and that IAB was therefore a joint controller in relation to the OpenRTB as well. It also found several breaches of the GDPR.
As a result, the DPA fined IAB €250,000. The decision was adopted pursuant to the cooperation procedure under Article 60 GDPR, in the context of which 21 supervisory authorities agreed with the DPA’s draft decision during the procedure.
IAB challenged the DPA decision
IAB challenged the decision before the Court of Appeal of Brussels (hereafter the Court). In particular, IAB claimed that the TC string did not constitute personal data, and that even if it did, IAB was not a controller for the processing in relation to the TC strings. In particular, it claimed that by creating the TCF, it merely set a standard for processing personal data across the organizations handling TC strings. In IAB's view, this did not amount to actually processing data.
Request for preliminary ruling
The Court of Appeal referred several questions to the CJEU. In 2024 the CJEU issued a preliminary ruling in which it confirmed (i) that TC strings were personal data[1] and (ii) that IAB was a joint controller for the processing in relation to the TC strings[2], along with the other recipients of the string.
The CJEU specified that its findings about IAB’s qualification as a controller, did not extend to the entire data processing happening through the OpenRTB protocol. In other words, IAB was a controller for the TC string processing, but it did not necessarily follow that it was a controller for the broader processing of personal data in the OpenRTB protocol for the purpose of targeted advertising.
The Court resumed the proceedings after the preliminary ruling of the CJEU.
Holding
On the nature of the TC string
Further to the preliminary ruling, the Court observed that IAB members - who were recipients of the TC strings - held data that could identify the data subject when combined with the TC string. This implied that the TC string qualified as personal data, irrespective of the possibility for IAB to actually identify users.
The Court then examined if IAB could actually identify users. It held that under IAB's internal policies, which are binding for the other participants in the TCF, IAB could require to access data which, in combination with the TC string, could identify users. The Court concluded that as IAB could require such information, it had reasonable means to identify the users.
For these reasons, the Court held that TC strings were personal data in the meaning of Article 4(1) GDPR.
On the processing of personal data
The Court then confirmed that once created, the TS strings are then structured and organized by IAB, which qualifies as a processing operation within the meaning of the GDPR.
On IAB’s controllership
The Court then examined if IAB qualified as a controller under Article 4(7) GDPR.
The Court noted that IAB shares a purpose with other participants in the TCF: that users preferences are captured in a structured way and the shared with other participants. Given its overriding control over the TCF, the Court found that IAB held clear decision making power both over the purposes and means of the processing.
Regarding the joint controllership, the Court distinguished between the processing in relation to the TC String and the processing in the context of the OpenRTB protocol. For what concerns the TC Strings, the Court confirmed that IAB was jointly responsible, with the TCF participants, for storing data subject's consent preferences in the TC string. It therefore qualified as a joint controller.
For the processing in relation to the OpenRTB, the Court however refused to follow the DPA's reasoning. It considered that the scope of the litigation was limited to the processing within the TCF and that the DPA did not sufficiently prove that IAB was a joint controller in the context of the OpenRTB protocol.
The Court therefore found that IAB's claim was founded only to the extent that the DPA decision considered that IAB acted as a joint controller in the context of the OpenRTB protocol.
On other violations
The Court mostly upheld the DPA’s findings and confirmed that IAB violated Articles 5(1)(a), 5(1)(f), 6, 13, 14, 24, 25, 30, 32, 35, and 37 GDPR.
In particular, the Court confirmed that:
- IAB had no legal basis under the GDPR to process TC strings. In particular, the Court confirmed the DPA's findings on the legal basis of legitimate interest: IAB failed to correctly balance its legitimate interest with that of the end users and, therefore, could not invoke legitimate interest as a legal basis for processing the TC string.
- IAB failed to inform website visitors about the processing of personal data, in violation of the controller's transparency obligations;
- the TCF did not meet GDPR standards for data protection by design and default;
- IAB failed to appoint a data protection officer and carry out a data protection impact assessment.
Conclusion
In conclusion, the Court upheld most of the DPA reasoning and confirmed the €250,000 fine imposed.
The only part of the DPA decision that was not confirmed was the extension of IAB's controller quality to the full OpenRTB protocol. The Court did not specifically decide on the matter but considered that it was out of scope of the present proceeding and that the DPA did not sufficiently justify its reasoning.
The Court also specified that the case would not be sent back to the DPA.
Comment
It is worth noting that the Court of Appeal assessed the case based on how TC strings were processed at the time of the complaints, under the now-outdated version 2 of the TCF. The Court did not examine later versions of the TCF[3].
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Kople Delivered
to:
art.792 GW
Freeofcourtfees-art.280,2°W.Reg.
Repertory issue Awarded to Awardedto i Awarded to
Date of ruling
May 14, 202S
BUR tBUR
Role number
2022/AR/292
N°
Nletrecordable
Final Judgment Court of Appeal
Art. 773 Eter.W.
Brussels
Section Market Court
19 room A
Judgment
Offeredon
Do not register
COVER 01-Q00Q438tI35-0001-0Q71-02-01-1
L 4CourtofAppealsBrussels-2022/AR/292-p.2
1. INTERACTIVE ADVERTiSING BUREAU EUROPE iVIW (IAB Europe), as registered in the
Crossroads BanL of Enterprises under the number 0812.047.277, with registered office at 1040
BRUSSELS, Place Robert Schuman 11,
Applicant,
Represented by Master CRADDOCK Peter Alexander, lawyer with offices at 1050 BRUSSELS,
Avenue Louise S4, Master JUDO Frank and Master VANDEKERCKHOVE Kwinten, lawyers with
offices at 1000 BRUSSELS, Keizerslaan 3 and Master VAN QUATHEM Kristof, lawyer with offices at
1210 SINT-JOOST-TEN-NODE, Bolwerklaan 21
AGAIN
2. DATA PROTECTIONlNGSAUTQglT as registered in the Crossroads Bank of Enterprisesnder
the number 0694.67a.g5o, with registered office at 1000BRUSSELS,
PrintingPressStreet35,
Defendant,hereinafterGBA",
Represented byMeesterROETSJoosandMeesterROESTimothy, attorneyatlaw withofficesin 2018
ANTWERPEN, Oostenstraat 38 bus 201
INTHEPRESENCEOF
3. AUSLOOS Jef with Ri}ks register number residingat
Free"willing"(No.1),
residingat
With Ri}ksregistry
number
Vij"willing"(No.2),
S.RYAN Johnn withnationalsocialsecuritynumber residingt
Voluntaryinterveningpart)"(No.3),
P*GE 00Q9384135-0DOZ-D071-02-01-t
01-DBrusselsCourtofAppeals-2022/AR/292-p3
6. FUNDACJA PANOPTYKON, foundation under Polish law, having its registered office at
Orzechowska 4/4, 02-068 WARSCHAU, POLAND, as representative of Ms. Katarzyna
Szymielewicz, residing at ul. Filtrowa 64/39, 02-057 WARSCHAU, POLAND,
Voluntaryintervenor(#4),
7. STICHTING BITS OF FREEDOM foundation under Dutch law, having its registered office at
Prinseneiland 97hs, 1013 LN AMSTERDAM, NEDERLAND,
VoluntaryInterventionParty"(No.5),
8. LIGUE DES DROITS HUMAIN ASBL, as registered in the Crossroads Bank for Enterprises under
the number 0410.105.805, with registered office at 1000 BRUSSELS, Kogelstraat 22, currently at
1080 BRUSSELS, Leopold ll avenue 53,
VoluntaryInterventionParty"(No.6),
Represented by Master DEBUSSERE Frederic and Master ROEX Ruben, both lawyers with offices at
1000 BRUSSELS, Rue Joseph Stevens, 7
allvoluntarilyinterveningpartiestogetherarehereinafteralsoreferredtoasthe "higher".
Inviewtheproceduraldocuments:
• theDecision No. 21/2022 in DOS-2019-01377 dated February 2, 2022 of the GBA Disputes
Chamber (hereinafter:the"Challengedles//ss/ng"orthe"8es/ decision") ;
• thepetition dated March 4, 2022, by which IAB Europe appeals against
aforementioneddecision;
• thepetitionforvoluntaryinterventionbyMr.Auslooseto/iiasfiled at
RegistryonMarch15,2022;
• theinterlocutory judgment the Market Court of 7 September 2022 in which it proceeded
to
(ask) (f)preliminary questions to the Court of Justice of the European Union
(hereinafter: "Ho/
ofJustice"'';
• thejudgmentoftheCourtofJusticeofMarch7,2024(C-604/22);
• thepetitionunderArticle748,§2,JudicialCodeas filedby
IABEuropeonOctober11,2024;
PAGE 01 -00004384135-0003-0071-02-01-4 BrusselsCourtofAppeals-2022/AR/292-p4
• the Market Court's order of Oct. 18, 2024, settling additional conclusion periods ;
• the(third)summaryconclusionsandbundlesofdocumentsascurrentlysubmittedbytheparties;
• the oral hearing on Jan. 8, 2025 at which the was taken under advisement for decision on
March 19, 2025 ; the debate on Jan. 8, 2025 was resumed o6 ovo in view of the change
in the seat of the Market Court following the interlocutory judgment as pronounced on
Sept. 7, 2022 ;
• the petition to reopen the debates under Article 773(2) Judicial Code as filed by IAB
Europe on Feb. 25, 2025 ;
• GBA'swrittencommentsonMarch7,2025;
• thecomplainants'writtencommentsonMarch7,2025;
The administration of justice proceeded in accordance with the law of June 15, 1935 on the use of
languagein court proceedings.
I. Factsandproceduralpredecessors
1.
IAB Europe is a Belgian-based international non-profit association representing companies in the
digital advertising and marketing sector at the European level. IAB Europe's members are both
companies in this - such as publishers, ecommerce and marketing companies and intermediaries
- and national associations, including the national IABs (Interactive Advertising Agencies), which in
turn include companies in that sector. IAB Europe counts among its members, among others,
companies that significant revenues from the sale of advertising space on Internet sites or
applications.
IAB Europe has the Transparency & Consent Framework hereinafter : "TCF"], being a "standard"'
consisting of guidelines, instructions, technical specifications, protocols and contractual obligations
that enable both Internet site or application providers and data brokers or advertising platforms
to processpersonaldataofInternetsiteorapplicationusers.
3.
The TCF aims to promote compliance with the AVG when those companies use the so-called
OpenRTB protocol, one of the most widely used protocols uoor Real nice Biddiny, that is, a
system for instantaneous automated
ThereisanongoingdiscussionbetweenpartiesaboutwhatexactlytheTCFis:astandard,anorm,acodeof
conduct,framework,framework,etc.
PAGE 01-D0004389135-000P-0071-02-01-W Court of Appeals Brussels -2022/AR/292 - p5
onlineauctionofuserprofilesforsellingandpurchasingadvertisingspaceontheInternet(hereinafter
: "RTB"). In light of certain practices engaged in by IAB Europe members the context of this
system of mass exchange of personal data to user profiles, IAB Europe proposed the TCF as a
possiblesolutiontobringthatauctionsystemintocompliancewiththeAVG.
In particular, from a technical standpoint, when a user visits a website or an application that
contains advertising space, ad technology companies, including data brokers and advertising
platforms, thousands of advertisers, can instantly bid on that advertising space behind the
through an automated auctionsystemthatusesalgorithmsinordertodisplayadvertisingtargeted
onthatadvertisingspacethatisspecificallytailoredtothat'sprofile.
TheContestedDecisionshowsthisschematically'asfollows:
The pOandRTBEcosystem
Buy-Side Sell-Side
TraÖngCloth
Team
dder Auctlon
Service Service
'uanagamen'
Platform
' Technicalanalysisreportofthelnspectorate,June4,2019,GBApieceA24.
PAGE 01-00004384135-0005-0071-02-01-4
L J Court of Appeals Brussels -2022/AR/292 - p. 6
UI:
Transparency
&UserChoice
" ",
\ ',. !:requirescentral governance ;
'< "'' ' decentralizedgovernance,fullycustomizable
4.
However, in order to display such targeted advertising, the consent of that user must first, in
principle, be obtained. Accordingly, when the user concerned first visits a particular website or
application, a consent management platform - a so-called Consent Management Platform
(hereinafter : "CMP") - will appear that enables him to grant the provider of the Internet site or
application permission to collect and process his personal data for predetermined purposes -
such as marketing or advertising in particular - or to share such data with certain providers, as
well as to object to various types of processing of such data ot their sharing on the grounds of the
legitimate interests invoked by providers within the meaning of Article 6(1)(f) of the AVG. These
personaldatarelateinparticulartothe'slocation,age, search history and recent purchases.
5.
In this regard, the TCF provides a framework for the processing of personal data on a large scale and
facilitates the recording of users' preferences through the CMP. These preferences are then
encrypted and stored in a letter and character string that IAB Europe calls the Transparency and
Consent String (hlerna : "TC Strlng "j, which is with personal data brokers and advertising platforms
participating in the OpenRTB protocol, so that they know what the user has consented to or objected
to. The CMP also places a cookie (euconsent-v2) on the users device. In combination, the TC String
and the euconsent-v2 cookie can be linked to the user's IP address.
PAGE 01-00004384135-0006-0071-02-01-4
L -J Court of Appeals Brussels -2022/AR/292 - p. 7
According to IAB Europe this was changed in the Iatest version 2.2 of the TCF, is not under here.
6.
TheTCFplaysaroleintheoperationoftheOpenRTBprotocol,asit provides theabilityto transcribe
preferences in order to communicate them to potential vendors, as well as to achieve various
processing purposes, the provision of advertisements. The TCF purportedly aims assure personal
databrokersandadvertising platforms through the TC String that the AVG has been complied with.
D'e GBA has received is 2019 complaints against IAB Europe (most of the complaints are from
other member states, one concerns that of Mr. Pierre Dewitte from Belgium) that concerned the
compliance of the TCF with the AVG.
The GBA investigated certain complaints (with an initial report from the inspectorate dated July
13, 2020) and then triggered the cooperation and coherence mechanism to reach a joint
decision approved by the (21*) national supervisory authorities in that mechanism.
8.
Thus, by a decision dated February 2, 2022 (hereinafter : "Ruling"), the GBA Disputes Chamber
held that IAB Europe was acting as a data controller with respect to the registration of the consent
signal and of the objections and preferences of individual users by means of a TC String, which the
GBA Disputes Chamber found to be linked to an identifiable user. In addition, in that decision, the
GBA Dispute Chamber ordered IAB Europe, pursuant to Article 100, 4 1, 9", WOG, to bring the
processing of personal data in the of the TCF into compliance with the AVG, and imposed several
corrective measures as well as an administrative fine (EUR 250,000.00) on it.
9.
OnMarch4,2022a,IABEuropefiledanappealwiththe Markets Court againsttheFeb.2,2022
decision.
10.
° Infact,therewereZ8becauseverschiI|endsupervisorsfromGermanyparticipated.
PAGE 01-00004384135-0007-0071-02-01-
L J Court of Appeals Brussels -2022/AR/292 - p. 8
IAB Europe,meanwhile,wasworking(inconsultationwiththeGBA)onmodificationstotheTCF.The
version under review here is version 2.0. On May 16, 2023, IAB Europe version 2.2 over which the
Market Court currently has no jurisdiction (see further below).
11.
Before the Market Court, IAB Europe stated that TC Strings are not personal data to it since IAB
Europe itself cannot trace the data back to an individual. It is only the other participants of the
system that can do so. For the same reason, IAB Europe would also not be a responsible party as
itallegedlydoesnothaveaccesstothe.
12.
OnSept.7,2022,theMarketCourthandeddownaninterlocutoryjudgmentinwhich,amongother
things,itreferred two preliminary questions to the Court of Justice that can be summarized as
follows :
1. ShouldaTCStringbeconsideredpersonaldata?
2. Should IAB Europe be considered a controller? If so, does this also apply to subsequent
processing by other organizations?
13.
On March 7, 2024a, the Court of Justice issued a judgment (C-604/22j (hereinafter : the
"Prejudicial Arresr").
Init,theCourtofJusticeruledasfollows:
"TheCourt(FourthChamber)declaresforjustice:
Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of individuals with regard to the processing of personal data
and on the free movement of such data and repealing Directive 95/46/EC (General Data
Protection Regulation) must be interpreted as meaning that a letter and character string
such as the TC string (Transparency and Consent String), which contains the preferences
of an internet user or an application user as regards his consent to the processing of his
personal data by internet site or application providers, as well as by personal data brokers
and advertising lotteries, constitutes personal data within the meaning of that provision,
inasmuch as that string makes it possible to identify the user concerned when it can linked
by reasonable means to an identifier such as, in particular, the IP address of that user's
device. The fact that a sectoral organization in possession of this string of characters
cannot,withoutexternalcooperation,accessthedataheldbyitsmembersisnot
PAGE 01-00004384135-0008-0071-02-01-U Brussels Court of Appeals - 2022/AR/292 - p9
within link
the standard established by it, nor that it" cannot that string to other data,
therefore, does not aon prevent that string from being personal data within the meaning of
the aforementioned provision.
not prevent that string of characters from being personal data within the meaning of the
aforementioned provision.
Article 4, paragraph 7, and article 26, paragraph 1, of
regulation 20J6/679 should be interpreted that:
- a sectoral organization which provides its members with a standard drawn up by it which
relates to consent the processing of personal data and which, in addition to binding technical
rules, also contains rules which' specify in detail how personal data relating to such consent
are to be stored and disseminated, is to be regarded as a 'joint controller' within the meaning
of those provisions if, having regard to the specific circumstances of the case, it' exercises, for
its own purposes, an influence over the relevant processing of personal data and thus
determines, together with its members, the purposes and means of that processing. The fact
that such a sector organization does not itself have direct access to the personal data
processed by its members within that standard does not it' from having the status of joint
controller within the meaning of the aforementioned provisions.
- the joint veronM'oorde///"k/lead of that industry organization does not automatically
extend to subsequent processing of personal data by third parties - such as Internet site or
application providers - with respect to users' preferences for the purpose of targeted online
advertising."
14.
After the Prejudicial Judgment, the parties took the case further into state and they were heard by
the Market Court on January 8, 2025 after which the case was under advisement.
II. Contesteddecision
InitsdecisionofFeb.2,2022,theGBADisputesChamberruledasfollows:
FOR THESE REASONS,
theDisputeChamberoftheDataProtectionAuthority,afterdeliberation,decidesto:
PAGE 01-D0004384135-00D9-007I-02-01-4
L -JCourt of Appeals Brussels -2022/AR/29Z - p.
CO
— Order the defendant, pursuant to Article 1"00, § 1, 9° of the WOG, to bring the
processing of personal data in the context of the TCF into compliance with the
provisions of the AVG by:
a. providing a valid legal basis for the processing and dissemination of users'
preferences in context of the TCF, in the form of a TC String and a euconsent-v2
cookie, as well as prohibiting the use of legitimate interests as a basis for the
processing7 '9 personal data by organizations participating in the TCF in its current
form, through the terms of use, in accordance with Articles 5.1.a and 6 of the AVG,'
b. imp/ement effective technical and organizational control measures to ensure
the integrity and confidentiality of the TC String, in accordance with Articles 5.1.f, 24,
25 and 32 of the AVG;
c.Maintainstrict vettingof organizations joining"theTCFtoensurethat participating
organizations comply with the requirements of the AVG, in accordance with Articles
S.1.f,24,25and32AVG;
d. take technical and organizational mootrege/en to prevent consent from being
checked by default in the CMP interfaces as well as participating vendors from being
automatically permitted on the basis of a legitimate interest, in accordance with
Articles 24 and 25 AVG;
e. impose on CMPs to adopt a uniform and AVG-compliant approach regarding the
in/ormotions that the latter submit to users, in accordance/rom Articles 12 to 14 and
24 of the AVG;
f. supplement the current register of processing activities, by including the processing
of personal data in the TCF by IA8 (urope, in accordance withArticle 30 of the AVG;
g. Conduct a Data Protection Impact Assessment (DIA) on the processing
activities under the TCF and their impact on the processing activities carried out
under the OpenRTB system, as well as update this DIA to future versions or
modifications to the current version of the TCF, in accordance with Article 35 of the
AVG;
h. appoint a data protection officer (DPO) in accordance with Articles 37 fot 39 of the
AVG.
PAGE 01-00004384135-0010-0071-02-01-
L -J Brussels Court of Appeals - 2022/AR/292 - p11
These compliance measures must be implemented within six months of the
validation of an action plan by the Belgian Data Protection Authority, which must be
submitted to the Litigation Chamber within two months of this decision. Failure to meet
the above deadlines will result in a penalty of EUR5,000 per day, pursuant to Article 100,
§ 1, 12° of the CPC.
— thedefendant,pursuanttoArticle101oftheWOG,anadministrativefineof
EUR250,000tobeimposed.
This decision may be appealed " the Market Court, with the Data Protection Authority as
respondent, in accordance with Article 108, § 1 of the WOG within a period of thirty days from
itsnotification.
ItisagainstthisdecisionthatthepresentactionisbeingbroughtbyIABEurope.
III. Claims of the parties
IABEuropeaskstheMarketCourtthroughitssynthesisconclusionofNovember15,2024:
Declare [IAB Europe's] appeal admissible and well-founded,'
- OienfollowingtheContestedDecisionNo. 21/2022datedFebruary 2, 2022inCaseNo.
DOS- 2019-01377:
o inchief order;
o Insubordinateorder, destroyandtransfertotheGBA;
o Inmost subordinateorder, set asideandsubstitute itsowndecisionprovided
organization of a consultation process.
— Order the GBA and the Complainants to pay the costs of the proceedings, including
rolling and court fees, the latter estimated at 1,800.
PerSynthesisConclusiondatedSept.27,2024,theGBAclaims:
Todojusticewithfulljurisdiction:
DeclareIABEurope'ssubstantivegrievancesunfounded,'
Accordingly, declare that IAB Europe has infringed the following provisions:
article5.1.aAVG;article6AVG;article12AVG;article13AVG ; article 14 AVG;
article 24 AVG; article 25 AVG; article S.1.f AVG ; article 32 AVG; article 30
AVG,'article35AVG;article37AVG,andthisinthemanneras
PAGE 01-00004384135-0011-0071-02-01-4
L J Brussels Court of Appeals - 2022/AR/292 - p12
set outin margin number 535 of the challenged decision No. 21/2022 of February
2, 2022 of the GBA Disputes Chamber ;
AlsodeclaretheproceduralgrievancesofIABEuropeunfounded,'Confirm,
consequently,thelegalityofthecontesteddecisionNo.21/2022ofFebruary2,
2022,andparticularofsanctions imposedthereinonIABEurope(contained in
the operative part at pp. 138-139);
Inany,todeclarethatIABEurope'sclaimisunfounded;
- In any event, order IAB Europe to pay the costs of the proceedings, including the
indexed basic amount of the procedural indemnity for non-pecuniary claims.
Onbehalfofvoluntarilyinterveningpartljenorcomplainants:
Togranttheapplicantsdeedoftheircustodialfree"willintervention;
Grant the GBA's motion to dismiss IAB Europe's appeal as unfounded.
IV. Resources
OnbehalfofIAB
Europe:
FIRST GRIEF : The the Dispute Chamber handled the proceedings is contrary to its duties
and powers as Data Protection Authority under the WOG and the AVG. It violates the
rights of defense of [IAB Europej and disregards the principle of due diligence as a
principle of good administration.
SECONDGRIEF:TheContestedDecisionisnotadequatelyreasoned.
THIRD GRIEF : The fact that the context of the case has changed completely on appeal
violates [IAB Europe's] right to a fair trial as well as the principles of equality and non-
discrimination.
FOURTH GRIEF : The the Dispute Chamber decides that TC strings are personal data is
insufficiently nuanced and reasoned.
FIVE GRIEF : The Contested Decision incorrectly states that [IAB Europe] processes personal
data.
PAGE 0l-D0O043B4135-0012-0071-02-01-4
L J Brusselsourt ofAppeals - 2022/AR/292 - p13
ZFSDE GRfEF : The Contested Decision incorrectly concludes that [IAB EuropeJ is a data
controller of TC Strings.
SEVENTH GRIEF : The Contested Decision erroneously concludes that [IAB Europej is a
joint controller of TC Strings and related data.
EIGHTH GRIEF : The Contested Decision wrongly concludes that (IAB Europej requires a
legal basis and that no legal basis exists for the processing of TC Strings and OpenRTB
data.
NINE GRIEF : The Dispute Chamber wrongly concludes that |IAB EuropeJ is in breach of
its duty of transparency.
TENTH GRIP F : The Contested Decision erroneously concludes that {IAB EuropeJ its
security, integrity and data protection obligations by design and default.
ELFTH GRIEF : [IAB Europe] does not have to conduct a data protection impact
assessment.
TWENTY-FIVE GRIEF : [IAB Europe) is not required to appoint a data protection officer.
THIRTEEN GRIEF : [IAB Europej has no legal obligation facilitate the exercise of data
subjects' rights.
FOURTEEN GRIEF : [IAB Europe] is not required to have a register of processing activities
and, in any case, it is not incomplete.
OnbehalfoftheGBA:
FIRST Grievance : Your Court lacks jurisdiction to rule again on the points of law raised in the
first grievance - Your Court has exhausted its jurisdiction (defense to IAB Europe's first
grievance),
SECOND GROUND OF APPEAL: IAB Europe's claim is inadmissible to the extent that it
relates to changes made to bicycle TCP after the 8-stage decision.
PAGE 01-0000fl384135-0013-0071-02-01-4
L Brusselsourt oAppeals - 2022/AR/292 - p14
THIRD PARTICULAR REMEDY : The violation of the prudence implicl1t established in the
interlocutory judgment need not to the annulment of the contested decision; at least it
can be remedied by Your Court.
FOURTH GROUND OF DEFENSE : The TC Strings do constitute personal data (defense to IAB
's fourth grievance).
FIFTH DEFENSE : In context of the TCF, personal data are processed (defense against
the fifth grievance of IAB Europe).
SIXTH GROUND OF Grievance : IAB Europe is a data controller of TC Strings (defense to IAB
's sixth grievance).
SEVENTH GROUND : IAB Europe is a joint data controller for the processing of TC Strings
and other data (defense to IAB Europe's seventh grievance).
EIGHTTH GROUND : IAB Europe must have a valid legal basis for processing TC Strings
and OpenRTB data but no such legal basis exists (defense to IAB 's eighth grievance).
NEGTHGROUND:IABEuropebreachesitsdutyoftransparency(defensetoIAB 'sfourteenth
grievance).
TtFNDE GROUND : IAB Europe violates its obligations regarding security, integrity and data
protection (defense to IAB 's tenth grievance).
ELFTH DEFENSE : Defense against IAB Europe's eleventh to fourteenth grievances: Impact
assessment is required (Art. 35 AVG), Data Protection Officer is required (Art. 37 AVG),
Register of processing activities is required (Art. 30 AVG) and IAB Europe must facilitate
the exercise of data subjects' rights (Arts. 15-22 AVG)
Onbehalfofvoluntarilyinterveningpartiesorcomplainants:
FIRST MIDDLE : The wiie on which the GBA handled the proceedings does not violate its
duties and powers as a data protection authority under the WOG and the AVG. It does not
violate IAB Europe's rights of defense, nor does it disregard the principle of due
diligence. Indeed, the WOG contains both inquisitorial and adversarial proceedings, and
the Dispute Chamber may also rely on a complainant's submissions and evidence without
having to have all the facts and allegations in a complainant's submissions examined by
the Inspectorate. Neither Articles 63 and 94
PAGE 01-0000438413fi-001q-0071-02-01-4Court oAppeals Brassel -2027/AR/292 - p.
1s
NeitherWOGnorArticle57.1.fAVGrequiretheDisputeChambertohaveallfactsand
allegationsina complainant's claims examined by the Inspectorate before a decision.
Article .1.f AVG has 2even no direct effect, so IAB Europe cannot derive any rights from it.
The only relevant test is whether theequalityofarmsandtherightsofdefenseofthe
defendant respected.This is the case when (1) the defendant knows, before its final
conclusion, which facts and which articles of law have been violated, (2) it is the last party
to have been able to submit a written opinion on the matter, so that it the last word, and
(3) the Dispute Resolution Chamber bases its decision solely on the pleas and arguments
contained in the parties' pleadings and documents and/or the report of the Inspection
Service. In that case, the defendant has been able to defend itself against all the factual
and legal pleas and arguments contained in the Complainant's Opinion and/or the
Inspectorate's Report, and a posteriori judicial review by the Market Court of the decision
in relation to the pleas and arguments contained in the 's Opinion is possible. In the
present case, those conditions have been , so that the equalityofarmsandIABEurope's
rightofdefense beenrespected.Forthesereasons,IAB Europe's first grievance is
unfounded and IAB Europe's claim to annul the decision of the Disputes Chamber based
on that grievance must be dismissed.
SECOND MIDDLE : IAB Europe's allegation that its right to a fair trial and the principles of
equality and non-discrimination have been violated because the context of the case "on "
before Your Court would have been completely different from the "first instance" before
the Dispute Chamber is completely false. After all, in an appeal against a decision of the
GBA Dispute Chamber, Your Court does not sit on appeal but at first and only instance. In
any event, the context of the case in this appeal is in no way changed from the
proceedings before the Dispute Chamber. For these reasons, IAB Europe's third grievance
is unfounded and IAB Europe's claim to annul the decision of the Disputes Chamber on
thatgrievancemust bedismissed.
THIRD MIDDLE : The Dispute Chamber correctly found that the processing of the TC String
constitutes "processing" of "personal data" within the meaning of Articles 4.1 and 4.2
AVG, as clearly confirmed by the Court of Justice. Indeed, the user preferences collected
in the TC String are information "about" a natural person who can be identified by online
identifiers, in particular the IP address. These personal data are then processed, i.e.
collected, structured, organized, disseminated and made available in accordance with
the mandatory requirements of the TCF. Accordingly, IAB Europe's claim that the decision
of the Dispute Resolution Chamber should be set aside on the grounds that there are no
personal data (fourth grievance) or that it does not involve the processing of personal data
(IAB 's fifth grievance) must be rejected.
PAGE 01-00004384135-0015-O071-02-01-W
L JBrusselsourtofAppeal-2022/AR/292-p.16
FOURTH MIDDLE : IAB Europe is the controller of the processing of personal data in the .
Indeed, the TCF itself, for which IAB Europe expressly declares that it responsible,
obliges participants to process personal data for the alleged purpose of bringing the
underlying processing of personal data through the OpenRTB auction system in line with
the AVG. In doing so, IAB Europe determines the purpose as well as the essential means
of processing personal data. Moreover, IAB Europe is jointly responsible for these
processing operations of personal data in the TCF with the other participants, namely the
CMPs, Publishers and Vendors who intervene, albeit later in the processing chain.
Therefore, IAB Europe's claim to annul the decision of the Dispute Resolution Chamber
on the grounds that it is not a data controller for the processing of personal data in the
TCF (sixth grievance of IAB Europe) or is not a joint controller with the participants in that
TCF (seventh grievance of IAB Europe) must be rejected.
FIFTH MIDDLE : IAB Europe's processing operations violate the basic principle of purpose
limitation, proportionality and necessity. Indeed, IAB Europe's processing operations are
not collected for legitimate purposes and result in the sharing on an immense scale of
personal data with all kinds of recipients, without such sharing being in any useful to the
processing operations the OpenRTB auction system into compliance with the AVG.
Consequently, IAB Europe also violates its accountability and obligation to develop the TCF
in a way that ensures data protection by design (violation of Articles 5 and 25 AVG).
Accordingly, IAB Europe's claim to annul the decision of the Dispute Resolution Chamber
on the grounds that IAB did not breach its obligations regarding data protection by design
and defaultsettings(partofIAB'stenthgrievance)must be dismissed.
SIXTH MIDDLE : IAB Europe's processing of personal data in the TCF violates the basic
principle of proper, lawful and transparent processing. Indeed, it does not have any legal
basis for the processing, has obtained the personal data in misleading way, and does not
provide either the complainants or any other data subjects with the legally required
information on the personal data processing operations it carries out. (violation of Articles
5, 6, 12, 13 and 14 AVG) Therefore, IAB Europe's claim to annul the decision of the Dispute
Resolution Chamber on the grounds that it does not need a legal basis for the processing
of personal data in the TCF (eighth grievance of IAB Europe) and on the grounds that it did
not violate the obligation of transparency (ninth grievance of IAB Europe) must be
rejected.
PAGE 01-000D4384135-0016-0071-02-01-
L -.J SEVENTH PLEA ! IAB Europe violates the principle of integrity and confidentiality because
it shares personal data within the TCF with an indefinite number of recipients without
verifying whether those recipients actually provide the necessary safeguards to protect
the personal data from unauthorized or unlawful processing. Accordingly, IAB Europe's
claim to annul the decision of the Dispute Resolution Chamber on the grounds that IAB
Europe did not breach its obligations of security, integrity and confidentiality (part of IAB 's
tenth grievance) must be dismissed.
EIGHTH MIDDLE IAB Europe violates the conditions for transfers of personal data to third
countries, as it has set up the TCF in such a way that personal data such as the TC String
are systematically transferred to numerous third countries without adequate protection
for these transfers. (violation of Article 44 AVG). Therefore, IAB Europe's claim to annul
the decision of the Dispute Chamber on the grounds that IAB Europe did not violate its
obligations regarding the transfer of personal data to third countries (part of IAB 's tenth
grievance), should be rejected.
V. Legalframework
GeneralDataProtectionRegulation(hereinafter"AVG"):*
Article4-7
Article12-14
Article24-26
Articles30,32,35and37
Article40
Article51.1
Article 57.1(a) and
(f) Article 58.1
° Regulation[Eur2016/679oftheEuropeanParliamentandoftheCouncilof27April2016onprotection
ofnaturalpersonswithregardtotheprocessingofpersonaldataandonfreemovementofsuchdata
andrepealingDirective95/46/EC(GeneralDataProtectionRegulation),Pb.t119,May4,2016
(hereinafter"AVG").
PAGE 01-00004384135-0D17-0D71-02-D5-4
L J Brussels Court of Appeals - 2022/AR/292 - p18
Article94
WOG :
Article58
Article63,1°-6°
Article94,1°-3°.
Article96
Article108
VI. ReviewbytheMarketCourt
Preliminary-Petitiontoreopen15.
On Feb. 25, 2025 (when the case was already under consideration at the Market Court), IAB Europe fileda
petitionforreopeningdebatepursuanttoArticle772Ger.W.filed.
On March 7, 2025, the GBA filed its comments regarding this request. The complainants joined the
G8A's comments by email dated March 7, 2025.
Subject of IAB Europe's request to reopen the debate, concerns the publication on February 6,
2025, of the conc(usion of Advocate General Spielmann in Case C-413/23 P (European Data
Protection Supervisor v. Joint Resolution Board) before the Court of Justice. In his Opinion, the
Advocate General analyzes, in particular, the notion of information "concerning" a natural person
andtheconditionoftheidentifiabilityof the persons concerned.
IABEuropecallsforareopeningofthedebatebasedonthispaperwhichitqualifiesasnewand
ofpredominantrelevancetothepresent.
The GBA believes that the request should be denied. It argues that the attorney general's
conclusion does not qualify as a newly discovered document or fact, at least that the conclusion
doesnot
S Act Dec. 3, 2017 establishing the Data Protection Authority, BS Jan. 10, 2018.
PAGE D1-0000438N135-0018-0071-02-01-
L y CourtofAppealsBrussels-2022/AR/292-p19
of
predominant importance because it cannot alter the Prejudicial Judgment down by the Court
of Justice in the present case.
16.
Article772Ger.W.states:(NADRUKMARKTENHOF)
"If,
during the course of the deliberations, a different party' discovers a new document or
f£*it of predominant interest, it could', as long as the judgment was not ui'9espeak ,request
the reopening of the debates ."
The application of the above-mentioned legal provision requires the document or fact to new,
i.e., it must have been discovered during the discussion, and to be of predominant importance,
i.e., it must be of specific utility to the . Thus, the document or fact must not have been known to
the requesting party or could have been known before the conclusion of hef .
17.
In the present case, the considers that the Advocate General's Opinion does indeed qualify as
new. Indeed, the opinion was published only after the case had already been for some four
weeks. Nonetheless, the Court is not convinced that the content of the Advocate General's
Opinion, however interesting, is of predominant importance.
That the notion of "personal data" is a relative concept is stated, inter alia, in margin number 26 of
the AVG. In , this margin number clarifies that, as far as the notion of identifiability of a natural
person is concerned, one must take into account all means that can reasonably be expected to be
used by the controller or by another person to directly or indirectly identify the natural person.
The Court of Justice also made reference to this reasonableness/relativity test in the Prejudicial
Judgment of March 7, 2024, placingthefinalassessmentinthisregardwiththeMarketCourt.
Moreover, in the conclusion in question, the Advocate General himself expressly* makes the link
to the Court of 's Preliminary Ruling of March 7, 2024 and reasons that case did involve personal
data because IAB Europe had reasonable means of indirectly accessing the identifying data.
18.
The Market Court does not consider the document to be of predominant importance and the
request to reopen the debates is therefore denied for that reason.
PROCEDURALGRIEVANCESOFIABEUROPEFOLLOWINGINTERLOCUTORYANDPRELIMINARYRULING
° Footnote 25 of the Opinion of February 6, 202S Attorney General Spielmann, in Case C-413/23.
PAGE 01-00004384135-0019-0071-02-01-4
L J Brussels Court of Appeals - 2022/AR/292 - p20
FIRST and SECOND GRIEF IAB Europe : The way the Dispute Chamber dealt with the is
proceedings
contrary to its duties and powers asG egevensbeschermingsautoritelt under the WOG and the AVG.
It violates the rights of defense of [IAB Europe) and disregardthedue diligence as a principle of
good administration and The Contested Decision is not adequately motivated.
Positionsofparties
According to IAB Europe, the way the Dispute Chamber handled the proceedings is contrary to
its duties and powers as Data Protection Authority under the WOG and the AVG, violates IAB
Europe's rights of defense and disregards the principle of due diligence as a principle of good
administration.
Invariably, according to IAB Europe, the Dispute Chamber failed to provide or provide adequate
reasons for the Contested Decision. Among other things, IAB Europe refers to the interlocutory
judgment of September 7, 2022 (no explanation of the one-stop shop rule).
The GBA posits that the Market Court has no jurisdiction to rule again on these grievances
because it has already ruled on them in the interlocutory judgment of September 7, 2022. It also
argues that the established violation of the duty of care and the duty to state reasons should not
leadtotheannulmentoftheContestedDecision.
Complainants GBA.
Judgment of the Market
Court19.
The first and second grievances from IAB Europe's November 15, 2024 summary judgment, come
correspond respectively to IAB Europe's seventh and eighth grievances assessed by the Court in
the interlocutory judgment of Sept. 7, 2022.
In other words, the interlocutory judgment has already ruled on IAB Europe's due diligence plea.
Specifically, the Interlocutory Judgment found that the Contested Decision itself does not make
sufficiently clear on the basis of which factual findings it is considered that TC Strings are
personal data within the meaning of Article 4(1) AVG. The Court held that the Disputes Chamber,
by processing, with respect to the TC String's qualification, the Complainants' additional
complaints and allegations, without more, after the hearing, did not conduct a proper
investigationandfact-finding.
Further, in the interlocutory judgment, the Court held that the Contested Decision was not adequately
reasonedinsofarasitconsiderstheGBAtobetheleadingappropri2ateauthority.
PAGE 01-00004384135-0020-007]-D2-01-4
L J Brussels Court of Appeals - 2022/AR/292 - p. 21
20.
On the other hand, the interlocutory judgment considers that IAB Europe's rights of defense
have been respected and rejects the violation of Articles 57(1) and S8(1) AVG and of Article 94
judgment
WOG. Indeed, the emphasizes that the Dispute Chamber did have the right to choose
to investigate the additional facts or complaints itself. The lnspectorate did not have to be .
It follows that the Court has already done justice on the points of law mentioned in the first two
grievances and to that has exhausted its jurisdiction. Therefore, the Court lacks jurisdiction to rule
againonthesepointsoflaw.
2L
By contrast, the interlocutory judgment has not yet ruled on the legal consequences to be
attached to the procedural pleas found to be partially well-founded. The Court has not yet
assessedwhetherandtowhatextentthepartiallyfoundedproceduralpleasshouldleadtoannulment
or reform of the Contested Decision. However, in view of the request of all parties "to assess the
substance of the present case", the Court has decided in its interlocutory judgment to proceed to an
assessment of the substance of the pending . It is precisely to facilitate this exercise that the
interlocutory judgment referred several questions of interpretation to the Court of Justice.
In the operative part of the present Final Judgment, the Court sets aside the Contested Decision for
the above-mentioned proceduralJ reasons insofar as the Disputes Chamber finds (without
conclusive investigation and fact-finding in this regard) that TC Strings are personal data within
the meaning of Article 4, point 1, AVG and insofar as it considers the GBA to be the leading
supervisoryauthoritywithoutspecificreasoninginthe Contested Decision in that .
22.
The legislative history of Article 108, § 1, of the Act of December 3, 2017 establishing the Data
Protection Authority shows that the Market Court adjudicates with full jurisdiction in the context
of an appeal against a decisionofthePlaintiff'sLitigationChamber.
This implies that, within the limits of the devolutive effect of the appeal, the Markets Court will
rule on all questions of law and fact as they were by the Data Protection Authority's Disputes
Chamber.'
Hee Market Court can thus in principle substitute itself entirely the Data Protection Authority in
its assessment.Itcannotreviewthedecisionappealedagainst.
SeeCass.Jan.10,2025,C.22.0110.N,concl.S.Ravyse,atwwwu tabe.
PAGE 01-00004384135-0021-0071-02-D1-4 Brussels Court of Appeals - 2022/AR/292 - p22
only destroy, but also reform. It can then make a decision that supersedes the challenged
decision.
23.
Now, using its full jurisdiction and taking into account the 's Prejudicial Judgment, let the Court
itself assess whether the elements in the administrative file can support the qualification of the
TC Strings as personal data, the existence of at least one cross-border processing and the
appointment of the GBA as the leading supervisory authority.
24.
It should be noted that the Market Court is in no way obliged by the AVG or under national to
organize a European consultation procedure as IAB Europe wrongly posits in (the body ) its
conclusion.
As to the characterization of TC Strings as personal data, the Market Court refers to what follows
in assessing IAB 's fourth grievance.
The existence of at least one cross-border processing and the appointment of the GBA as the
lead supervisory authority are assessed by the Market Court as part of the analysis of IAB 's fifth
grievance.
THIRD GRIFF IAB Europe : The fact that the context of the case has changed completely on violates
[IAB Europe's] right to a fair trial as well as the principle of equality and non-discrimination.
S and u and an a and
According to IAB Europe, the GBA deprived it of an effective remedy and violated its right to
dissent. IAB Europe says it must "defend itself for the first time on appeal against a completely
changed context. She argues that any party but herself is entitled to her case fully tried twice.
She says there are violations of both Article 6 ECHR and Articles 10 and 11 of the Constitution.
According to the GBA, it is evident that the changes allegedly made by IAB Europe to the TCF not
relevant in assessing the legality of the Contested Decision. "Indeed, as a general rule, the legality of a
decisionmustbeassessedatthetimeitwasmade"and
' SeeCass.Dec.12,2019,C.18.0250.N,cl.R.Mortier,atwwwuportaI.be.
PAGE 01-0000438413£-0022-0071-02-01-4 Court of Appeals Brussels -2022/AR/292 - p23
"based on the data as they were available at the time (they) were taken." Just as IAB Europe
emphasizes that no admission to its detriment can be inferred from the adjustments made to the TCF,
neither can it be inferred from these adjustments that the Dispute Resolution Chamber's assessment
of the TCF (as it was before the Dispute Resolution Chamber at the time of the Contested 8 Decision)
would wrong.
JudgmentoftheMarketCourt
2S.
In an appeal against a decision of the Disputes Chamber of the GBA, the Court does not sit in
appeal but in first and only instance (Article 108 CPC). In this sense, the objective
contentiousness with which the Market Court was charged differs from the subjective
contentiousness handled by the "ordinary" courts appeal.
26.
In any event, the context of the case in this story is in no way changed from the proceedings
before the Dispute Chamber. The Court reviews the TCF not in the amended version but in the
version submitted to the Dispute Chamber. The Market Court does not even have jurisdiction over
TCF version 2.2, because it is caught on the Contested Decision and that deals only with TCF
version 2.0.
The notion of full jurisdiction arising from Article 108 WOG coupled with Article 78 AVG is v'ilar from
the notion concerning the devolutive power of appeal (Article 1068 Ger. W.) and both cannot be used
interchangeably. In light of the broad powers available to a supervisory authority, according to the
ECJ, the requirement of effective judicial protection is not met if the decisions of a supervisory
authority are only subject to limited judicial 2ouden review. Therefore, the Court considers that such
a decision must be subject to full judicial review. The essence of that full judicial review is that the
parties can, within the limits of the devolutive effect of the appeal, put forward a comprehensive
defense before the Market Court, also with respect to facts dTe were not or insufficiently addressed
in the Contested Decision (obviously to the extent that these facts predate the Contested Decision
itself).
27.
Therefore, no violation of Article 6 ECHR or Articles 10 and 11 of the Constitution is demonstrated.
?'ic' Dnde more ECJ December 7, 2023, C-26/22 and C- 64/22, UF and AB v. Tand Hessen (SCHUFA), marg.
53- 59.
PAGE 01-00004384135-0023-0071-02-01-4 For these reasons, /A8 Europe's third grievance is unfounded and fA8 Europe's claim to set aside
the Contested Decision of the Dispute Chamber based on that grievance mustbe dismissed.
GRIEVANCESOFIABEUROPEREGARDINGTHEMERITSOFTHECASE
Prior
28.
1. In the case before it, the Market Court was called upon by the GBA and the complainants to
rule on both the substantive and procedural issues in dispute between the parties, and this,
in order to ensure the full and effective effect of the AVG in the internal legal order. In the
interlocutory judgment, the Market Court held that the Contested Decision certain (purely)
procedural defects. In order to the full and effective effect of the AVG in the internal legal
order, it seems appropriate - also in view of the Preliminary Judgment of the Court of Justice -
that the Market Court should also rule on merits of the infringements of the AVG withheld
by the Litigation Chamber (at least the extent that those merits are disputed by IAB Europe
and thus are the subject of the opposing debate before the Market Court). In doing so, the
Market Court systematically the correctnessofthematerialgroundsoftheContestedDecision,
followingPrejudicialJudgment,andcompletes or replaces them where necessary or useful.
2. Article 5.2 AVG states that the data controller must be able to demonstrate compliance with
the principles of the AVG (accountability). To the extent that IAB Europe qualifies as a data
controller (see below), it bears the burden of proving compliance with the AVG and cannot
invokeArticle870Ger.W.toshift thatburdenofproofto the GBA or the complainants.
FOURTH and FIVE GRIEF IAB Europe : IAB Europe seeks the annulment of the Contested
Decision of the Dispute Chamber on the grounds that it does not involve personal data (fourth
grievance) or that it does not involve the processing of personal data (fifth grievance)
FourthandviyfthdefensesGBA,thirdpleacomplainants.
Stand unte va a e
In its fourth grievance, IAB Europe argues that the Contested Decision violates Article 4(1) AVG
and the substantive duty to state reasons by qualifying the TC String as personal data within the
meaning of the aforementioned provision.
In its fifth grievance, IAB Europe argues that the Contested Decision failed to demonstrate that IAB
Europe itself processes personal data within the meaning of Article 4(2) AVG. Merely
demonstrating
PAGE 01-00004384135-0029-0071-02-05-4
L J BrusselsCourtofAppeals-2022/AR/292-p25
That "in the context of the TCF" personal data are processed is not sufficient, according to IAB
.Until it is shown that IAB Europe itself processes TC Strings, it could nobe considered a
Europe
data controller, nor could the TC Strings bepersonaldata.
The
GBA, supportedinthis bythecomplainants, argues that theTCString personal dataandthat the
TC String is processed as it captures a user's preferences through automated processes
(even if the user refuses everything) and IAB determines its storage and dissemination.
Judgment of the Market Court
0thContestedDecision
29.
TheContestedDecisionfinds(marginnumbers302etseq.):
"302. Although the Litigation Chamber understands that it has not been conclusively
established that the TC String, due to the limited metadata and values contained therein, in
itself allows for direct identification of the user, the Litigation Chamber finds that when the
consent pop-up is requested by means of a script from a server managed by the CMP, it
inevitably also processes the user's IP address, which is explicitly classified as personal data in
the AVG.
303. Indeed, peripheral number 30 AVG provides that notuurliy individuals can be linked to
online identi/icotors through their devices, applications, tools and protocols, such as Internet
Protoco/ (IP) addresses, identification cookies, or other identifiers such as radio frequency
identifier logs. This can leave traces that, especially when' combined with unique identifiers
and information received by the servers, can be used to create profiles of natural persons and
recognize notational persons.
304. Once a CMP stores or reads the TC String on a user's device using a euconsent-v2
cookie, consent or objection to processing based on a legitimate interest, as well as that
user's preferences, can be linked to the IP address of the user's device. In other words, CMPs
have the technical means to IP addresses (as indicated in their pop-up) and combine all
information related to an identifiable person. The ability to combine the TC String and the IP
address means that this is information from an identifiable user.
PAGE 01-00009384135-0025-0071-02-01-4 Court oAppeals Brussels2022/AR/292 - p26
305. Moreover, an identï/ication of the user is possible by linking to other data that can be
by participating organizations within the TCF, but also in the context of OpenRTB. 0e Dispute
Chamber underlines in that respect that to
are not any parties, but participating or 9ni aSies - CMPs and vendors- which, examined in
more detail below, are required to disclose information with which
they can identify users, to communicate to the defendant, upon its simple request.
306. Accordingly, the Dispute Chamber finds that the Respondent has reasonable resources
at its disposal that it can employ with respect to registered organizations participating in the
TCF, which enable the Respondent to directly or indirectly identify the naturalIy person behind
a TC String.
307. The Litigation Chamber also understands that the TCF inherently aims and therefore
storing a combination of preferences from each user in the form of a unique string in the TC
String, in order to communicate these preferences to a large number of adtech vendors.
308. Indeed, the Dispute Chamber finds, based on the inspection reports, that the adtech
vendors as well as other participants within the broader OpenRTB ecosystem lend the signal
stored in a TC String to determine whether they' have the required legal basis for processing
a users personal data for the purposes to which the user has consented.
309. In this regard, the Litigation Chamber emphasizes that it is sufficient that certain
information is used in order to individualize a natural person (single outJ to be able speak of
personal data. Also, the purpose of the TC String, in particular the purpose of capturing the
preferences of a well-defined user, leads de facto to the TE String being considered as
personal data."
ThePrejudicialJudgment
30.
TheCourtofJusticeconsidersasfollows:
"42. In the present be" noted that a letter and character string such as the TC String contains
the preferences of an Internet user or a user of an application regarding foË his consent
to the processing by third parties of his personal data or of data about the objection he may
have made to the processing of his personal data for an alleged legitimate interest as referred
toinArticle6(1)([) AVG.
PAGE 01-00004384135-0026-0071-02-01-4
L JBrusselsourtoAppeals-2022/4R/292-p.27
43 Even if a TC String would not by itself contain data byeans of which the data
subject can be directly i'dentified, it' contains to begin with thesonal preferences of
a specific user with regard to his consent to the processing of his personal data, where it
goot beinformation"about a(...) natural " within the meaning of Article 4, point 1, AVG.
44 In addition, it is also certain that linking the information contained in a TC String
to an idenfificaror such as, in particular, the IP address of the device of the user in
question can make it possible to draw up a profile of this user and to actually identify the
person to whom that information specifically refers.
45 Since a user can be'i'dentified by linking a letter and character string such as the T6
String with additional data, such as, in particular, the IP address of that user's device or other
identifiers, it should be considered that the TC String contains information about an
identifiable user and thus personal data within the meaning of Article 4(1) AVG, which is by
marginal 30 of the AVG, whichexplicitlyrefers tosuchasituation.
46 This interpretation is not altered by the mere circumstance that IAB Europe
couldnot itself linktheTCStringtotheIPaddressof apebruiyer'sdeviceandhasnodirect
accesstothedataprocessedwithintheTCFbyitsmembers.
4F Indeed, as the case law recalled in paragraph 40 of this judgment shows, that
circumstance 9"oes not prevent a TC String from being considered as "personal data
"withinthemeaningofArticle4(1)AVG.
48 Moreover, it appears from the file in the Court's possession - and in particular
from the decision of February 2, 2022 - that the members of IAB Europe are obliged
to provide that organization, at request, with all the information that would enable it to
identify users whosedataarestoredinaTCString.
49 Thus, subject to the verifications to be out by the verwljzende rechter In this
regard, IABEurope- thankstotheinformationtobeprovidedtoit byitsmembersandother
organizations participating in the TCF - appears to the reasonable means, to in marginal
number26oftheAVG,toidentifyagivennatural personbymeansaTCString.
PAGE 01-D000P384135-0027-0071-02-01-4 Court of Appeals Brussels -2022/AR/292 - p28
50 It follows from the foregoing that a TC String constitutes personal data within the
meaning of Article 4(1) AVG. Itis' irrelevant in this regard that withoutexternal cooperation,
which it may require, such a sector organization does not have access to the data that its
members vert+'er within the standard it has established, nor can it link the TC String to
otheridentifierssuchas,inparticular,theIPaddressofa'sdevice."
ReviewbytheMarketCourt
TCStringaspersonaldata
31.
The definition of personal data in Article 4(1) AVG includes essentially four elements, which are
cumulatively important for judging whether or not certain information should be considered
personal data. These are (i) any information (ii) about (iii) an identified or identifiable (iv) natural
."
32.
In addition, a person is considered identifiable if he or she can be "identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location data,
an online identifier or to one or more elements characterizing the physical, physiological, genetic,
mental,economic,culturalorsocialidentityofthatnaturalperson."Fringenumber30oftheAVGclarifies
that natural persons can also be linked to online identifiers, as found in IP addresses and
identificationcookies.
33.
The first condition for talking about personal data is "information." Data are described as objective
facts. Once they acquire meaning, information arises. The nature and content of the information is
. The form of the information or the medium is also . Some data have a dual nature in that they
both provide information about a person and allow a natural person to be identified.
34.
The second condition states that information must concern or be about a natural person. The
GBA implicitly states, followed therein by other supervisors, in the aforementioned margin number
309 of the Contested Decision, that in order to speak information concerning a natural , (only) one
of the three following elements
" DEBOT,O.,TheapplicationoftheGeneralDataProtectionRegulationintheBelgiancontext.
CommentaryontheAVG,theDataProtectionAct,andthe/2edatabesc/iermingsourorityAct,
WoltersKluwer,2020,p.100,marginnumber273.
PAGE 01-00004384135-0028-0071-02-01-
L Court of Appeals Brussels -2022/AR/292 - p29
must be present : content data (infomation about a person) as personal data, purpose data (data
used with I t the purpose of assessing a person) as personal data or result data (data that have
potential effects on a person's rights or interests) as personal data. This position of the supervisors
is not followed by everyone in the legal doctrine, and hence the importance of the Prejudicial
Judgment."
35.
This second condition therefore plays an important role when the Dispute Chamber or the
Market Court has to adjudicate (relatively) new technologies such as TC Strings. Sometimes, as
in the present case, information (contained in the data) is in the form of a character and letter
string and not persons. In that case, the information is deemed to be only indirectly persons.
36.
ThethirdconditionstatesthattheprotectionoftheAVGappliesonlytonaturalpersonsorhuman
beings.
37.
Finally, the fourth condition states that the information must relate to a natural person who is
identified or identifiable (directly or indirectly).
Applicationinroncrero
38.
Asnotedabove,theMarketCourtisexercisingitsfulljurisdictionhere.
39.
In essence, the TCF is designed to ensure that all parties involved in the digital advertising chain -
fromadvertiserstopublishers-complywiththerulesoftheAVG.Itallowsusers to give or withhold
their consent to the processing their personal data for advertising purposes. These preferences
are collected and recordedinaso-called"TCString,"whichisthenusedwithintheRTBsystem.
40.
ItcannotbereasonablydisputedbyanyofthedatasubjectsthataTCStringisinformationandthat a
natural person is or may involved at least indirectly.
41.
" DE BOT, D., The application of the General Data Protection Regulation in the 8th/gisc/le context.
Comments ontheAVG,theDataProtectionActandtheDataBescfiermïngsoutoriteifAct,
WoltersKluwer, 2020, p. 105 marg. 284.
PAGE 01-00004384135-0029-0071-D2-01- Brussels Court of Appeals - 2022/AR/292 - p30
Remains to examine whether it is information concerning a natural person (second condition) and whether
that natural person is identified or identifiable (fourth condition).
42.
ThePreliminaryRulingitself clarifies thefulfilment of thesecondconditioninparagraphs 43 to 48 of
the Preliminary Ruling, quoted above, which explicitly confirm that the TC String " contains the
personal preferences of a specific user in relation to his consent to the processing of his personal
data, where it is information 'relating to a (...) natural person'within the meaning of Article 4(1) of
theAVG."
43.
Also with regard to the fourth condition, the Prejudice/Arresc provides interpretation in the aforementioned
marginal numbers.
44.
However, in order to finally decide whether a TC String is personal data within the meaning of
Article 4(1) of the AVG, it is necessary, in accordance with the Prejudice Judgment, ufor the
Market Court to examine whether IAB Europe has reasonable means to identify a particular
natural person by means of a TC String.
45.
Asalreadyheldabove,theherebyexercisesitsfulljurisdiction.
46.
TheMarketCourtconsideredasfollows.
The report of the inspection service (document A133 administrative file GBA : EN version of the
z
report) states :'
"IAB Europe developed a Transparency and Consent (Exhibits Nos. 30 to 36 and No. 38 of
file DOS-2019-01377) in which it imposes binding rules on participating organizations,
whose membership is also subject to a financial contribution. These binding rules concern
the processing of personal data in the context of online advertising. IAB Europe exercises a
form of control in this ecosystem and refers to itself as a "Managing Organization."
More concretely.
Itisimportanttonotethattheacronym"MO"isanabbreviationfortheEnglishManaging
OrganizationormanagementorganizationandinthiscontextIABEurope meantbyit.
PAGE 01-00004384135-0030-0071-D2-01- AppealBrussels-2022/AR/292-p.31
- IAB Europe determines binding lists of processing purposes by referring to "Purposes
and Features Definitions" and "Purpose and Feature Definitions" in an "Appendix A"
[Appendix A] (Exhibits Nos. 32and38of FileDOS-201901377, respectively);
- IAB Europe determines the wl)ze of processing by imposing "Policies" (policies) on
"CMPs" (Consent Management platforms) (Consent Management Plotform hereafter o/geyort
cMPJ , "Vendors" (sellers) and "Publishers" (publishers) participating in the Transparency
ond Consent Framework (Exhibits Nos. 32and38of fileDOS-2019-01377);
- IAB Europe imposes binding rules on participatingthrough its document "Terms and
Conditione for the IAB Europe Transparency & Consent Framework" "Terms and
Conditions"). Oit document contains, inter aliaonbIad sides 5 to 6 the obligations for
participants ("Your Obligations") and on pages 6 to 7 an obligation to make a financial
contribution to the ecosystem ("Payment") (Betalfng ) Exhibit No. 33 of Dossier DOS-2019-
01377)."
In IAB Europe's "Current tcf policy" (piece A038 from the GBA administrative file), the
Articles8and15thefollowing:(ADDRESSMARKTENHOF)
"B.Recordkeeping
1. A CMP will maintain records of consent, as required under Framework Policies
and the Specification, and will provide the MO access to such records upon request
without undue delay."
Translatedas:
"8.Registration
1. A CMP maintains records of consent, as required by the Framework and the
Specificatfe, and gives the MO access to these records upon request without undue
vertrap!np."
"J5. Accountability
1. The MO may adopt procedures for periodically reviewing and verifying a Vendor's
compliance with Framework Policies. A Vendor will provide, without undue delay, any
information reasonably requested by the MO to verify compliance.
2. The MO may suspend a Vendor from participation in the Framework for its failure
to comply with Framework Policies until the Vendor comes into full compliance and
demonstrates its intention and ability to remain so. The MO may expel a Vendor from
PAGE 01-00004384135-0031-0071-02-01-4 Brussels Court of Appeals - 2022/AR/292 - p32
participationintheFrameworkforviolationsofFrameworkPoliciesthatarewillfuland/or
severe."
Translatedas:
"15.Accountability
1. The M0 may establish procedures for periodically assessing and verifying a Vendor's
with the Framework. A Vendor shall provide without undue delay any in/ormot/e
reasonablyrequestedbytheMotoverifycompliancele.
2. 2. The MO may suspend a Vendor from participation in the Framework for failure to
comply with the Framework until the Vendor fully complies with the Framework and
demonstrates its intent and ability to with the Framework.
The MO may exclude a Vendor from participation in the Framework in the event of' willful
and/or serious violations of the Framework."
The Terms conditions of IAB Europe (piece A033 from the administrative file GBA) states in article 7
: (ADDRESS MARK TENHOF)
"7) Our Obllgations
b) tou agree that we and IAB Tech Lab may access, store and use any information that you
provide in connection with your participation in the Framework in accordance with the terms
of our Privacy Policy at https://www.iabeurope.eu/privacy-policy/, as updated from time to
time."
Translatedas:
"7)Ourobligations
(b) You agree that we'and IAB Tech Lab may access, store and use any Information d'you
provide in connection with yourparticipation in the Frameworkin accordancewith the terms of
our Privacy Policy at https.'//www.iabeurope.eu/privacy-policy/, as updated from time to
time."
47.
It is indisputable from all the aforementioned articles that, thanks to the information that its
members and other organizations participating in the TCF are required to provide to it, IAB Europe
has at its disposal resources that it and/or the participating organizations can reasonably be
expected to use(orcoulduse)to(in)directlyidentifyanatural.
PAGE O1-0DD04384135-0032-0071-02-01-4
L J Court of Appeals Brussels -2022/AR/292 - p33
48,
However, the fact that IAB Europe itself would not have the reasonable means to proceed with
Identification because it cannot make the link between a TC String and the IP address and would
not have direct access to the personal data, is in itself irrelevant. This is explicitly confirmed by
the Court of Justice in margin numbers 46 and 47 of the Prejudicial Judgment as quoted above.
It follows from the foregoing that a TC String is personal data within the meaning of Article 4(1)
AVG.
Isthereanyprocessingofpersonaldata?
49.
Article 4(2), AVG defines a "processing operation" as "any operation or set of operations which is
upon personal data or sets of personal data, whether or not by automatic means, such as
collection, recording, organization, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignmentorcombination,blocking,erasureordestruction."
50.
The TC Strings, once created, are then processed, i.e. collected, structured, ordered, distributed
and made available in accordance with the binding rules of the TCF. IAB Europe as management
organization and central figure in the digital ecosystem thereby determines the storage and
dissemination of the TC String.
The Contested Decision, by establishing in margin numbers 317-321 that at least the vendors collect,
process, store and share personal data - what Article 4(2) AVG calls "providing by means of
transmission" - has legally justified the processing of personal data within the of the
aforementioned provision.
According to the TCF Technical Specifications, sharing the TC String with CMPs is done in two ways :
a. storing the TC String in a shared global consent cookie on the
consensu.orginternetdomainofIABEuropeor
b. storing the TC String in a storage system chosen by the CMP if it is a
service-specificconsentsignalconcerns.
PAGE 01-00004384135-0D33-0071-02-01-U BrusselsCourtofAppeals-2022/4R/292-p34
In both cases, personal data are processed. Of course, IAB Europe's intervention in the
processing was all the more consequential in the shared global consent cookie hypothesis.
Indeed, that shared global consent cookie in which the TC String is stored refers to the
consensu.org domain from which CMPs can access and update the gedee(the TC String. This
domain was registered and managed by IAB Europe.
Both this causing the TC String to be stored in a shared cookie, and making the TC String
available to TCF participants via this central consensu.org domain, were clearly processing of
personal data within the meaning of the AVG.
52.
Regardless of the g/oja/ consent cookie and the consensu.org domain, there is processing of
personal data in the TCF managed by IAB Europe :
O user preferences are collected through a CMP and the CMP also gets the 's IP
address at that time ;
0 userpreferencesarestructuredandorderedinaTCString;
0 the TC String is retained, distributed and made available to participants in
the TCF.
53.
Contrary to what IAB Europe states, this is not merely a theoretical conclusion, but a concrete
conclusion based documents (see, among others, documents C1 to C4 of the complainants :
bailiff's and/or notary's records of processing operations' . Nor is it merely a "standard" that
would not in itself constitute processing as IAB Europe argues: the TCF is a framework that
makes certain processing happen in a certain way, otherwise the would not work at all.
Obviously, the participants themselves choose whether they want to participate, but as soon as
they join, they are obliged to process the personal data (the user preferences and corresponding
identifiers) within the . After all, the TCF includes, as
'° ProcessreportofbailiffHendrikusOudeElferinkdatedFebruary15,2021with findings of
Jef Ausloos (official and unofficial version), Process report of bailiff Jordane Pirard dated
February 16 lebtuari 2021 with findings of Pierre Dewitte (official and unofficial version),
Affidavit ["affidavif "j dated February 12, 2021withfindingsofJohnnyRyan(officialand
unofficialversion),NotarizeddeednotaryAnnaRutowiczdatedFebruary3,2021with
findingsofKatarzynaSzymielewicz(of(icial version and free English translation).
PAGE 01-00004384135-0034-0071-02-01-4 Brussels Court of Appeals - 2022/AR/292 - p35
already mentioned, also have a mandatory character, whereby the rules and regulations
contained therein are additionally by IAB Europe.
Isthereanycross-borderprocessingofpersonaldata'
54.
Asannouncedabove,theMarketCourtalsoexercisesfulljurisdictionhere:
Data flows to countries within the European Union do occur within the system described above
(TCF). This appears from paragraphs 5 to 11 of the Contested Decision and the documents from
the administrative file as submitted by the GBA. However, it does not appear from the documents
submitted to the Court that, as far as IAB Europe is concerned, there is a transfer to third
countries within the meaning of Article 44 AVG.
Account must therefore be taken of Article 1, point 3, AVG, which provides that the free
movement of personal data in the Union may neither be restricted nor prohibited for reasons
connected with the protection of natural persons with regard to the processing of personal data.
Article 423) AVG clarifies the concept of cross-border processing in following terms :
"(a) processing of personal data in the course of the activities of establishments in more than
one Member State of a controller or of a processor in the Union which is in more than
one Member State; or (b) processing of personal data in the of the activities of one
establishment of a controller or of a processor in the Union which materially affects orislikely
tomateriallyaffectdatasubjectsinmorethanoneMemberState."
TheGBAastheleadsupervisoryauthority
Asannouncedabove,theMarketCourtalsoexercisesfulljurisdictionhere:Peripheral Number 11 of
the Contested Decision states :
"The defendant has its sole registered office in Belgium, but its activities have a significant
impact on interested parties in several Member States, including the complainants in
Ireland, Poland and the Netherlands, as well as in Belgium." The Dispute Chamber draws its
jurisdiction on a combined reading of Articles 56 and 4(23)(b) of the GBA. The GBA was
caught by the Polish, Dutch and Irish data protection authorities following a
PAGE OI-DDDO#38#135- OB3S-0071-DB-01-'1 Brussels Court of Appeals - 2022/AR/292 - p36
complaint of the complainants to' them, in accordance with Article 77.1 AVG. It declares that it
the leading supervisory autorireir (orticle 60 AVG)."
56.
This summary justification should be supplemented by the following findings from the
inspection report (Exhibit A133 GBA) showing (page 8 and following) that the GBA can only act
astheleadsupervisoryauthoritywithrespecttoIABEurope'°andlimitedtor the TCF.
The lnspectorate justifies this on pages 10 and 11 of its report as follows : (EMPHASIS MARKETSHOF)
The registered office of IAB Europe is located Place Robert Schuman No. 11 in 1040 Brussels
(Belgium) and is registered with" the Crossroads Bank for Enterprises under No. 0812.04
7.2776, location confirmed in its "privacy policy" (piece No. 41 of file DOS-2019-01377).
According to Article S6 § 1 of the AVG, the GBA is therefore the main supervisory
authority for the Transparency and Framework.
IAB Europe is the data controller for the Transparency and Consent Framework, as
describedabove.
IAB Europe developed a Transparency and Consent Framework (Exhibits Nos. 30 to
36 and No. 38 on file D0S-2019-01377) in which it' imposes binding rules on
participating organizations, whose membership also subject to a financial . These binding
rules relate to the processing of personal data in the context of online advertising. IAB Europe
oe/ent out a uorm of confro/e In this ecosystem and venvysr to itself as "Managing
Organizaf/on" (managing organization).
TheMarketCourtconcurredwiththeabovefindingsfromtheinspectionreport.Given
allthatprecedes,bothIAB'sfourthandfifthgrievancesareunfounded.
SIXTH and SEVENTH GRIEF IAB Europe : The Contested Decision erroneously concludes that IAB
Europe is a processor of TC Strings (§§322-361) and The Contested Decision erroneously concludes
that IAB Europe is a joint processor of TC Strings and related data (§§262-400).
4
' TheInspectoratenotesthatasfarasAuthorizedBuyersareconcerned,theGBAisnottheleadsupervisory
authoritybutrathertheIrishregulatorandthatIABTechtaboftheUnitedStates notaprocessorfor
RNB.
PAGE 01-000D4384135-0036-0071-02-D1-4 Brussels Court of Appeals - 2022/AR/292 - p37
SixthandseventhdefensesGBA,fourthpleacomplaining.
sSvattinanntenda e
Through its sixth grievance, IAB Europe challenges the Dispute Resolution Chambers
characterization of IAB Europe as a data controller with respect to personal data that might be
processed by TCF participants. IAB Europe argues that even if it were deemed to have some
degree of control over the resources, that does not necessarily make it a data controller.
Regarding its seventh grievance, IAB Europe claims that the reasoning of the Contested Decision
is unclear and incoherent and that the Dispute Resolution Chamber fails to clearly establish who is
a (joint) controller or processor for which processing operations. The assessment of IAB Europe's
joint (joint) processing responsibility with the CMPs, publishers and vendors is seriously flawed,
according to IAB Europe.
Both cases, according to IAB Europe, involve a manifest error of judgment on the part of the
GBA.
The GBA argues that IAB Europe responsible for the processing of TC Strings under the TCF as it
exercises (within its own agenda as Managing Organisation) decisive influence on the processing
through the framework it has set up. The real purpose of the framework is to enable and
promote the purchase and sale of online advertising space. IAB Europe establishes the essential
means by bindingly prescribing, among other things through the TCF, how CMPs should capture
users' consent or objections in a TC String. Finally, the Dispute Chamber is mindful that IAB
Europe also participates in determining the purpose and means of processing personal data
under the OpenRTB.
Regarding IAB Europe's seventh grievance, the GBA reiterates that IAB Europe is a joint data
controller. Both CMPs and publishers and Adtech vendors are joint data controllers. However,
this joint processing responsibility cannot detract from IAB 's responsibility.
The complainants argue that IAB Europe is a controller of the processing of personal data in the TCF
itself given its overriding control over the operation of the . It is IAB Europe as the authoritative
industry organization that organizes, coordinates and promotes the processing operations within
the TCF, while the participants in the TCF merely perform what IAB Europe has prescribed. The
participants in the TCF are joint controllers with IAB Europe : IAB Europe decides on the general
purposesandmeansofthe
PAGE 01-00004384135-0037-0071-02-01-'‹
L y Court of Appeals Brussels -2022/4R/292 - p38
processing of personal data in the TCF, while the other participants decide on implementation in
their own contexts.
Macktenhof verdict
57.
According to Article 4, point 7, AVG, the "processing controller/j "ye" is the "natural person or
rec/ir person, an over/ieids institution, a service or other body which/which, alone o/ together with
others, determines the purposes and means of processing personal data" (NADRUK
MARKTENHOF).
OeContestedDecision
58.
TheContestedDecisionconcludesinsectionB.2thatIABEuropeisresponsiblefortheprocessingofTCStrings
undertheTCF(edgenumber361oftheContestedDecision).
59.
Thereasonforthisisthreefold.
First, the framework set up by IAB Europe - the TCF - plays a decisive role in the collection,
processing and dissemination of users' preferences, consents and objections, regardless of
whetherIABitselfcomesintocontactwiththese(marginal330ofthe Contested Decision).
Second, the documentation accompanying the TCF shows that the purpose ("why") of the TC String
and of its processing within the TCF was defined by IAB Europe. According to this documentation,
the TCF was developed to capture, document and transmit Internet users' transparency and consent
data in a standardized manner (marginal 338 of the Contested Decision). However, it is clear from
the list of objectives contained in the TCF that the real purpose of this framework is to enable
and promote the purchase and sale of online advertising space (edge number 336 of the Contested
Decision).
Third, the Contested Decision considers that IAB Europe has also defined the essential means of
processing TC Strings (i.e., "whose data, what data, how Iang and by whom are they
processed"¦). Indeed, it is IAB Europe that the TCF prescribes in a binding manner how CMPs
should capture users' consent or objections in a TC String, how vendors can access the TC
managed by the CMP in a standardized manner, how this TC String should be stored in a cookie,
which CMPs and
PAGE 01-00004384135-0038-0D71-02-0i-4 Brussels Court of Appeals - 2022/AR/292 - p39
vendorsmaybecommunicatedtheTCStringandwhatcriteriadeterminehowlongtheTCString
shouldberetained(marginal360oftheContestedDecision).
ThePre)udicialJudgment
60.
TheCourtconsidersthefollowing:(EMPHASISMARKETSCOURT)
"60
In view of the foregoing, it must be assumed that the first part of the second preliminary
question seeks to determine whether a sectoral orgaization such as IAB Europe can be
classifiedasajointcontrollerwithinthemeaningof Articles 4(7) and 26(1) AVG.
61
To that end, therefore, it must be assessed whether that organization - given the
particular circumstances of the case - influences for its own purposes the processing
uan personal data such as the TE string and determines together with others the
purpose of and the means for that processing/ng.
62 As,first,thepurposeofsuchprocessingofpersonaldata,itappears
- subject to the checks to be carried out by the referring court - from the file in the
Court's possession, as in paragraphs 21 and 22 of this judgment, that the TCF
drawn up by IAB Europe is a standard intended to ensure compliance with the AVG
whenthepersonal dataof users of an Internet site or application are processed by
certain companiesparticipatingintheonlineauctioningofozonespace.
63 Thus, the TCF is essentially designed to promote and enable the sale and purchase of
advertising space on the Internet by those companies.
64 Therefore, subject to the verifications to be carried out by the referring court, it can be
assumed that IAB Europe, for its own purposes, influences the processing uan personal
data at issue in the main proceedings and thereby, together with its members,
determines the purpose of such processing.
65 Secondly, as regards the means for such processing of personal data, it is clear from the
file in the Court's - to checks to be carried out by the referring court - that the TCF is a
standard which the members of IAB Europe are expected to if they" wish to" join" that
association. In particular, IAB Europe - as it confirmed at the hearing before the Court -
may, with regard to one of its members that the
PAGE D1-00004384135-0039-0D71-02-DI-4
L Brussels Court of Appeals - 2022/AR/292 - p40
rules of had TCF not complied with, take a suspension decision for non-compliance that
may result in the member concerned w'or being excluded from the TCF and,
consequently, for the processing of personal data it performs through TC-strings, not
being able to rely on the AVG compliance guarantee that this system is supposed to
provide.
66 In addition, from a practical point of view - as mentioned in paragraph 21 of this
judgment - the TCF prepared by IAB Europe contains technical specifications for
processing the TC string. In particular, those specifications describe precisely how CMPs
should record the preferences that users have regarding the processing of their
personal data, and how those should be processed in order to a TC string. Furthermore,
it also lays down precise rules on the content of the TC string as well as on the storage
and sharing uan that .
67 Thus, the decision of February 2, 2022 shows that IAB Europe prescribes in these ,
among other things, thestandardizedwayinwhichthevarious parties involvedin' the
TCF can consult the preferences, objections and consents listed in the TC string .
68 Therefore, subject to the findings to be made by the referring court, it must be
assumed that a sectoral body such as IAB Europe influences, for its own
purposes, the processing of personal data at issue in the main proceedings and
thus determines, together with its members, the means of those processing
operations. It follows that, in accordance with the case-law recalled in paragraph 57
of this judgment, it' must be regarded as a 'joint uer processing controller' within the
meaningof Articles 4(7) and26(1) of the AVG."
ReviewbytheMarketCourt
In the present case, after verification by the Market Court, it is clear that IAB Europe has real
decision-making power, both over the purposes and means of processing within the , and this
given its overriding control over the operation of the TCF :
a) IAB Europe acknowledges its responsibility for the TCF in its own documentation
62.
IAB Europe itself states in its "Frequently Asked Questions" on the TCF (version 2.0) that it isresponsible
fortheTCFPolicies.'°
'* See,availableathttps://iabeurope.eu/wp-content/uploads/2019/08/TCF-v2.0-FAQs-1.pdf(ExhibitB.15,
complainants p. 2-3).
PAGE 01-00004389135-D040-0071-02-01-4
L y Court of Appeals Brussels -2022/AR/292 - p41
For example, in response to the question "Who manages the TCF?" she states the following :
(NADRUKKFN MARKTENHOF)
"The Managing Organization (BO) is IAB Europe. IAB Europe works
closely with IAB Tech Lab to jointly observe the management of the
participating organizations, experts and working groups that let create
joint policies and technical specifications underlying the TCF." Within
its role as BOufodraa IA e the s e ele
ve antwoo de i k for the F Policies co'm[rmitit,e and let manage the
Global Vendor List (GVL) and the administration of the permission
management plat(orms. IAB Tech Lab is responsible for the development
and iterations regarding the technical specifications associated with the
TCF."
AndinitsTCFPolicies,IABEuropedefinesitselfas:(ADDRESSMARKETHOFj
"the entity that administers and governs the , understanding the
Policies de ¿pec//icoties and the GVL. IAB Europe may update these
Policies from time to time as it' reasonably deems necessary to the
continued success of the Framework."
63.
IAB Europe thus acknowledges to be responsible for the Policies, the Specifications as well as the list
of Vendors allowed to participate in the TCF. It goes without saying that the organization thus
managing and administering the TCF is also 'responsible for it, including any processing of
personal data imposed and organized by the 7CF. Indeed, it is IAB Europe that enforces these
processing of personal data on the other participants.
Thus,IABEuropestipulatesintheTCFPolicies:(ADVERTISEMENTMARKETHOF)
"A CMP must comply with all Policies applicable to CMPs distributed by
the management orqanization in the Policies o/ in the documentation
implementing the Policies, such as in operational Policies and procedures,
guidelines,andenforcementdecisions."
IAB Europe thus states that all CMPs are obliged to strictly follow IAB Europe's instructions within
the , even IAB Europe's enforcement decisions. In addition, IAB Europe obliges CMPstoimplement
theTCFaccordingtoitsTechnicalSpecifications:(NADRUKMARKTENHOF)
"InadditiontoimplementingtheFrameworkaccordingtothe
Specifications, a CMP must support the fulliqe Speci(ications
supportunless'the
PAGE 01-00004384135-0041-0071-02-01-4
L J Court of Appeals Brussels -2022/AR/292 - p42
Specifications explicitly state that a particular property is optional, in which
case the CMP may choose to implement the optional property but is not
required to so."
64.
IAB Europe essentially argues that it would only be a small industry organization that wishes to
players in the digital marketing ecosystem a standard or even a code of conduct for possible
processing of user preferences.
65.
In its decision, the Dispute Chamber correctly found that IAB Europe does process personal data
with the TCF (marginal numbers 317-321 of the Contested Decision). The Board of IAB Europe
includes several of the largest Vendors and Publishers in the world, including Microsoft, Google,
etc. (Complainants' Exhibit E.5). Thus, this is indeed a central body that with decisive influence
makes certain processing of personal data happen.
IAB Europe's essential raison d'être is indisputably to represent the interests of the digital
advertising industry. It therefore exerts an influence on the processing of personal data for its
own purposes.
66.
In edge number 330 of the Contested Decision, the Dispute Chamber indicates that it considers
IAB Europe to be a data controller for the collection, processing and dissemination of users'
preferences, consents and objections and therefore for the processing operations in within the
TCF.
b) On determining the purpose and means of these processing operations, IAB Europe
indeed exercises a decisive influence
67.
• IAB Europe has a shared purpose with the other participants for the processing of
personaldata,whichincidentallyallhavethesame[shared1purpose,whichistoensure that
user preferences are captured in a structured way and then shared with all other
participants. Even though many TCF participants maybecompetitors,whenitcomestothe
processing of user preferences under the TCF, they all have similar interests, which are also
similartothoseofIAB
PAGE 01-0 0D0 # 38 R 135 - DD # g - 007 1 -0 E-0 1 - #
L J Brussels Court of Appeals - 2022/AR/292 - p43
Europeasanindustryfederation:ensuringthatdigitaladvertisingpracticessuchasOpenRTBcan.
• IAB Europe organizes, coordinates and promotes the processing of personal data in the .
Indeed, IAB Europe itself states that it manages and administers the TCF and describes
in detail its organizing and coordinating task. Indeed, it determines the minimum
personal data to be , the means for sharing the TC String, and above all, it also enforces
compliancewiththeTCF.
• The concept of a data controller in this case |just doesJ have to interpreted broadly,
since IAB Europe is the only one who, as it itself states, manages and administers the TCF and
can therefore resolve the issues identified by the Dispute Resolution Chamber, after
consultation with all other EU regulators.
TheDisputeChamberthereforecorrectlyfoundintheContestedDecisionthatIABEuropeis a data controller
for the processing of TC Strings within the TCF.
c) The qualification of IAB Europe In the Contested Decision as joint controllers
68.
JointresponsibilityexistsunderArticle26AVG:
"Where two or more controllers jointly determine the purposes and means of processing,
they shall be joint . They shall determine in a transparent manner their respective
responsibilities for compliance with the obligations under this Regulation, in particular as
regards the exercise of the rights of the data subject and their respective obligations to
provide the information referred to in Articles 13 and 14, by means of an arrangement
between them, except if and to the extent that the respective responsibilities of the
controllers are determined by a provision of Union or Member State law applicable to the
controllers. The scheme may a contact point for data subjects.
2. The arrangement referred to in paragraph 1 shall make clear the respective roles
the joint controllers and their respective relationships with data subjects. The substantial
content of the arrangement shall be made available to the data subject.
3. Notwithstanding the terms of the arrangement referred to in paragraph 1, the data
subject may exercise his rights under this Regulation in relation to and against any
controller."
PAGE 0l-00DD4384135-0043-0O71-O2-01-4
tïi*,hO- CourtvalnappealBrussels-2022/AR/292-p44
69.
The Contested Decision finds in section B.3 that IAB Europe together with the TCF participants
(CMPs, publishers, vendors) are jointly responsible for the processing of personal data in the
context of the TCF and of the OpenRTB.
70.
In edge number 544 of the Contested Decision, the Dispute Chamber does not find that IAB
Europe is solely responsible for the processing of personal data under OpenRTB. The proportion of
the TCF participants' respective responsibilities varies depending on the stage of processing (TCF
versusOpenRTB)anddependingonwhethertheyactinsideoroutsidetheTCF.
71.
IAB Europe denies that it qualifies as a joint data controller with publishers, CMPs and adtech
vendors for the processing of personal data under the TCF and OpenRTB.
It should be generally pointed out that the Dispute Chamber's finding in the Contested 8
Decision, that a party other than IAB Europe also exercises influence over the purposes and means
of , in no way implies that IAB Europe not.
72.
No document submitted to the Market Court shows how IAB Europe and the TCF participants have
agreed on a mutual and transparent arrangement regarding their respective responsibilities as
requiredbytheaforementionedarticleoftheAVG.
73.
The Court of Justice, subject to verifications to be made by the referring court, ruled in the
Prejudicial Judgment that IAB Europe is a joint data controller with respect to the processing of
personal data it carries out jointly with its members through TC strings within the TCF (Prejudicial
Judgment,marginnumber68).
However, the Court of Justice also ruled the following in the Prejudicial Judgment :
(NADRUKKEN MARKTENHO£)
"70. In addition, in response to the doubts of the dissenting judge, it must be held that any
joint responsibility of that sector organization does not automatically extend to subsequent
processingofpersonaldatabythirdparties,suchas
PAGE 01-00D04384]3£-OD44-0071-O2-01-4
L yCourt of AppealsBrussels -2022/AR/292- p45
providersofInternetsitesorapplications,users' preferencesforthepurposeoftargeted
onlineadvertising.
71. In this regard, it should first be noted that the "processing" of personal data is defined
in Article 4, point 2, AVG as "any operation or set of operations which performed upon
personal data or sets of personal data, whether or not by automatic means, such as
collection, recording, organization, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, blocking, erasureor destructionof data."
72. Thisdefinitionmakesit clear that theprocessingof personal datamayconsist of one
ormoreoperations,eachofwhichrelatestoadifferentstageofthatprocessing.
73. Second, it follows from Articles 4(7) and 26(1) of the AVG - as the Court has already
held - that a natural oy legal person can be regarded as jointly responsible for the processing of
personal data only if it" determines jointly with others the purposes and means of that
processing. Accordingly, that natural or legal person - without prejudice to any civil liability
provided for by national law in this regard - cannot be regarded as being responsible, within
the meaning of those provisions, for processing operations which take place earlier or later
in the processing chain and for which, respectively, he' does not determine the purposes and
means (see , by analogy, judgment of 29 July 2019, Fashion ID, C-40/J7, EU.'C.'2019:629,
paragraph74).
74. In the present case, a distinction must be made between, on the one hand, the
processing of personal data by the members of IAB Europe - namely, Internet site or
application providers and data brokers or advertising platforms - when" storing the
consent preferences of the users concerned in a TC string according to the standard
established in the TCF and, on the other hand, the processing of personal data that
these companies and ¢ferrfen subsequently carry out on the basis of those preferences,
for example, by forwarding those to third parties or personalized advertising offers to those
users.
75. Subject to the verifications to be carried out by the referring court, IAB Europe
does not appear to involved in such subsequent processing, so that it must be
considered that such an organization is not automatically jointly responsible with those
companies and third parties for the processing of personal data on the basis of the information
containedinthepersonal dataof theapplicant.
basedonthepreferencedatastoredinaTCstringfortheaffectedusers.
76. Therefore, an industry organization such as IAB Europe can only be
deemedresponsiblefor suchsubsequent processingonly if it is establishedthat it has
influence
PAGE D1-00006384135-0D45-0071-02-01-9
L Court of Appeals Brussels -2022/AR/292 - p46
exerts on the determination of the purpose of such processing and of the manner in which it is
carriedout, whichtherejectingcourt must ascertaininthelight of all therelevant circumstances of
themainproceedings."
Thus,itmustfirstbeconsideredhowtheContestedDecision'sco-responsibility
ofIABEuropeforprocessingpersonaldatainthecontextofTCFjustified.
74.
Step-by-step and reasoned, the Dispute Chamber states why and for what IAB Europe is responsible, as
well as with whom :
• personal data are processed within the TCF (margin number 321 of the Contested
Decision) ;
• the purpose for processing personal data within the TCF, with in particular the TC
String, is defined by IAB Europe in its TCF Policies (margin number 338 of the
Contested Decision) ;
• IAB Europe determines the means of processing personal data within the TCF, with
in particular the TC String (marginal 360 of the Contested Decision) ;
• IAB Europe is responsible for the processing of personal data within the TCF, with
particular reference to the TC String (margin number 361 of the Contested
Decision);
• Moreover, IAB Europe is jointly responsible for the processing of personal data
within the TCF, with in particular the iC String (marginal 402 of the Contested
Decision), together with :
o theCMPs(marginalnumbers382and38JoftheContested8decision};
o thePublishers(marginnumbers392-394oftheContestedDecision)and
o theVendors(marginnumber399oftheContestedDecision).
75.
The above demonstrates that in the Contested Decision, the Dispute Chamber has established the
limits IAB Europe's responsibility. The "offering" or obligation by IAB Europe of a "standard" or
framework (TCF) for AVG compliance must in the present case and in light of the above-mentioned
documents in the file actually be considered a processing purpose in itself
COVER 01-0000438P135-0046-0071-02-D2-1 BrusselsCourtofAppeals-Z022/AR/29Z-p47
considered for which IAB Europe is equally responsible as its members. fAB Europe is therefore in
a position to safeguard the rights of data subjects and to comply with the obligations by the
AVG.
IAB Europe is thus jointly responsible with TCF participants for storing the consent preferences
of the affected users in the TC String.
TheContestedDecisioniscorrectlyreasonedonthispoint.
Next, it must be considered how the Contested Decision justified IAB Europe's co-responsibility
for the processing of personal data In the context of OpenRTB.
76.
ftTB stands for real-time bidding. RTB is a way to buy and sell ads through real- time auctions,
meaning transactions are made in the time it takes for a Web page to load.
77.
When an Internet user visits a Web site, his or browsing habits on that Web site are (often)
tracked to enable personalized advertisements. Personal information regarding the user is then
matched with available advertisers and a real-tïme auction takes place between advertisers that
meet certain criteria. A distinction must be made here between data processing by the providers of a
websiteorapplication and subsequent data processing by third parties. A simple example : a user
visits a website offering organic dog food, but does not buy anything. The next moment, that same
user visits a news website and suddenly sees ads about organic dog food. These ads are placed
usingreal-timebidding.
78.
The ECJ states that the joint responsibility of IAB Europe and its members for the processing of
consent preferences in a TC string must be distinguished from the processing of personal data
based on those preferences (in the context of Open RTB). The CJEU also notes that IAB Europe
does not IAB Europe appear to be involved , and thus does not IAB influence, such subsequent
processing,suchas,forexample,theprovisionof personalized advertising offers to users.
79.
Thus, with respect IAB Europe's co-responsibility for further processing under OpenRTB, following
the Pre-Judgment, the Market Court must itself assess whether IAB
PAGE DI-0 0 00 0 38 # 13S-00 # 7-0071-0 E-OK- #
L BrusselsCourtofAppeals-2022/AR/292-p48
Europe with the TCF "influences" the further processing of personal data under OpenRTB.
Indeed, that assessment was not yet made by the Court of Justice as the GBA correctly notes In
its conclusions.
ThecomplainantsargueinBandNo.T77oftheirconclusions:
"Thiscaseconcerns theprocessingofpersonal datain thecontextofthe.WhileOpenRTBis
the motivating reason for IAB Europe why the TCF came , it does not look at the specific
processing of personal data that takesplaceinOpenRTB."
The GBA defends a slightly different view : 2it tries to argue in the Contested Decision that the
TCF does not stand alone but serves OpenRTB (edge number 370 of the Contested Decision),
that acts / subsequent processing of CMPs, of publishers and of TCF vendors outside theTCFareof
interest and lead to IAB Europe co-responsible for them. It refers for that purpose to what is
described in margin numbers 367 and following of the Contested Decision : (NADRUK
MARKTENHOF)
"367. Both in its conclusions and during the hearing, IAB Europe emphasized that the T€F and
the OpenRTB system are completely independent of each other, in the sense that adtech
vendors, even without participating in the TCF, can freely process personal data within the
framework of the OpenRTB. Complainants, on the other hand, have always mentioned the
inherent interconnectedness between OpenRTB and the TCF, which the defendant itself
confirms - according to complainants - in the TCF Implementation Guidelines.
368. The Litigation Chamber finds that the defendant's argument cannot be followed, given
that the defendant, on the one hand, repeatedly states in its conclusionthat the very reason
for the existence of the TCF is to bring the processing of personal data based on the OpenRTB
protocol in conformity with the applicable regulations,including the AVG and the ePrivacy
Directives. While the Litigation Chamber understands that the TCF may be used for other
applications by publishers, whether or not incollaboration with CMPs, it is equally certain that
the TC£ was never intended to be stand-alone,onayhankelif'kecosystem.
369. On the contrary, the Litigation Chamber finds that the Transporency and Consent
Framework includes policies and technical specifications that should enable publishers of
websites and applications (publishers) and adtech partners that support the torgeting,
delivery and measurement of advertising and content (vendors) to obtain consent or
establish objections, transparently disclose their processing purposes, and establish a valid
legal basis for processing personal data for the provision of digital advertising.
PAGE 01-0O004384135-0048-0071-02-02-W CourtofAppealsBrussels-2022/AR/292-p49
370. Thus, the Litigation Chamber finds that the decisions translated by IAB Europe into, on
the one hand, the provisions uan the policies and technical speci)ications uan the TEL and, on
the other hand, the means and purposes determined by the participating organizations with
respect to the processing - whether in the framework of OpenRTB or not - of users' personal
data, should be considered as convergent decisions . Indeed, IAB Europe d/edf an
ecosystem within which users' consent, objections and preferences are collected and
exchanged not for their own purposes or self-preservation , but to facilitate further
processing by third parties (i.e. publishers and adtech vendors) re.
371. Consequently, the Litigation Chamber finds that IAB Europe and the respective
participating organizations should be considered as joint controllers for the collection and
subsequent "dissemination of users' consents, concerns and preferences, as well as for the
related processing of their personal data, without, however, the responsibility of participating
CMPs and adtech vendors detracting from the responsibility of IAB Europe."
ThefollowingmarginnumbersfromtheContestedDecisioncontradicttheforegoingfindings
OftheDisputesChamber:(ADJOURNMENTMARKTENHOF)
"495. Although the Litigation Chamber has already ruled in this decision on the processing
operations carried out in the OpenRTB and concluded that these processing operations do not
comply with the fundamental principles of purpose limitation and data minimization (since no
guarantee is provided to ensure that the personal data collected and disseminated in the that
the personal data collected and disseminated within the framework of the OpenRTB are
limited to in/ormotions strictly necessary for the purposes envisaged), the Dispute Resolution
Chamber again stresses that the complainants have indicated in their conclusions that they
limit the scope of their allegations to the processing operations within the TCF. Also, the
Inspectorate has clarified in its report that IAB Europe does not act as data controller for the
processing operations carried out entirely under the OpenRTB protocol.
544. Wot the nature and purpose of the processing, and more the nature of the data, the
Dispute Chamber notes that the TC String, as an expression of users' preferences regarding
the processing purposes and potential adtech vendors offered through the CMP interface, is
the cornerstone of the TCF. Although the scope of this decision is the TCF and its TC Sfr/ng, and
the sanction imposed on the Respondent relates solely to that framework, the compliance of
OpenRTB with the AVG is assessed as part of a holistlsche
PAGE 01-000D4384135-0049-D071-02-02-4 Court of Appeals Brussels -2022/AR/292 - p50
analysisof theTCFanditsInteractionwiththeAVG. SincethecurrentversionoftheTCFis
let tool on which the Defendant relies to demonstrate its compliance with the AVG, and
since the Defendant facilitates membership and use of the OpenRTB for a significantIy
number of participating organizations, the Dispute Chamber considers that the IAB
Europe plays a central role with respect to the OpenRTB, without beinga data in that
context."
IABEuropeconcludesinthepresent(marginal39etseq.ofitsbriefs):
"By extending the scope of the decision to OpenRTB and its stakeholders, the Dispute
Resolution Chamber lost the ability to clearly distinguish the roles of the parties and their
corresponding responsibilities, for the various data processing operations. Very often it is
unclear what data the Dispute Chamber is talking about, whose interests it's' into account
andwhoitconsidersresponsibleforwhat."
80.
TheMarketsCourtfindsthattheContestedDecision thusinconsistentlyreasonedonthispoint.
The Market Court further considered that in their briefs, the plaintiffs indicated that they limited
the scope of this lawsuit to the processing operations within the TCF.
Moreover, the Court notes that the lnspectorate itself clarifies in its report that IAB Europe does
not act as a data controller for the processing operations carried out entirely under the OpenRTB
.
In any event, none of the documents submitted to the Court indicate that IAB Europe is acting as
a (joint) data controller for the processing operations carried out entirely under the OpenRTB
protocol.
Based on the foregoing, IAB Europe's sixth grievance is unfounded and IAB Europe's seventh
grievance is only well-founded to the extent that the Contested Decision suggests, but does not
show, that IAB Europe is acting as a (joint) controller for the processing operations carried out
entirely under the OpenRTB .
GRIEVES RELATING TO THE ADOPTION OF THE INFRINGEMENT ON THE AVG IN THE DECISION
81.
TheContestedDecisionestablishesthefollowingviolations:
"The Dispute Chamber found in the Contested Decision that IAB Europe infringed the
following articles:
PAGE 01-00009384135-0DS0-0071-02-02-Brusselsourt oAppeals- 2022/AR/29Z- p.
51
• Articles 5.1.a and 6 AVG - The current TCF does not provide a legal basis for processing
users' preferences under the form of a TC String. Moreover, the Dispute Chamber notes
that the TCF offers two bases for the processing of personal data by participating adtech
vendors, but finds that neither can be used. First, data subjects'consent is currently not
given in a sufficiently specific, informed and granular man. Second, thelegitimateinterest of
the organizations participating in the TCF does not outweigh the interests of data subjects,
given the large-scale processing of their TCF preferences under the OpenRTB and the
impact it may have on them. Since none of the grounds for lawfulness listed in Article 6
AVG apply to this processing, as explained above, the Defendant is in breach of Articles
5(1)(a) and 6 AVG.
Noting that the respondent itself no longer has any factual or technical control over the TC
Strings once they have been generated by the CMPs and stored on users' cfpporots,
the Dispute Resolution Chamber considers that it cannot oblige the respondent to
remove a posteriori all TC Strings generated to date. More , it is the responsibility of the
CMPs and publishers implementing the TCF to take appropriate measures in accordance
with Articles 24 and 25 of the AVG to that personal data collected in violation of Articles 5 and
6 of the AVG are no longer processed and are also deleted. To the extent that IABEurope is
still storing TC Strings derived from the no longer available globally scoped consent cookies,
the Dispute Chamber also considers that the Defendant should take the necessary
measures to ensure that thesenolonger necessarypersonal dataareperm¢entlydeleted.
• Articles J2, J3, and 14 AVG - The way the information is provided to data subjects does
not meet the requirement of a "transparent, understandable and easily accessible form."
Users of a website or opp/icoty participating in the TCh do not receive sufficient information
about the categories of personal data about them and, moreover, cannot determine in
advance the scope and consequences of the processing. The information provided to
users is too general to the specific processing of each vendor, which also makes it
impossible to determine the granularity - and thus the validity - of the consent obtained for
processing carried out using the OpenRTB protocol. Data subjects cannot know in advance
thescopeandimpact of theprocessing
PAGE 01-00D04380135-0051-0071-DB-02-4
L .JBrussels Court of Appeals- 2022/AR/292- p.
52
overseeandthereforedonothavesufficientcontrolovertheprocessingoftheirdatato
nottobesurprisedlaterbythefurtherprocessingoftheirpersonaldata.
• Articles 24, 25, S.1./ and 32 AVG - As explained above, under5(1)(f) and 32 AVG, the
controller is obliged to the securi9y of the processing and the integrity of the personal data
processed. The
LitigationChamber that thecombinedreadingof Articles 5(1)(b) and 32, as well as Articles
5(2) and 24 AVG (which the controller to the principle of accountability) requires the
controllerto demonstrate compliance with' orïke/ 32 AVG by implementingappropriate
technical andorganizational measures in a transparentandtraceable manner . Under the
current TCFsystem, adtechvendorsreceiveaconsent signal without any technical or
organizational measures to ensure that this consent signal is valid or that an adtech vendor
has actually received the signal (rather than having generated it). In" the absence of
systematic and automated monitoringsystemsof theparticipating
CMPs andadtechvendorsby theDefendant, theintegrity of the TC String is not sufficiently
guaranteed, as it possiblefor the CMPs tofalsify thesignal togenerateaeuconsent-v2
cookieandthus reproduce a"false consent" from users for all purposes and for all types of
partners. As indicated above, this hypothesis is also expressly included in the terms and
conditions of let TCF. The Litigation Chamber therefore finds that IAB EuropeInits capacity
ManagingOrganizationhas designed and provides aconsent management system, but does
not take the necessary steps to ensurethevalidity, integrity andcomplianceof preferencesas
well as users' consent. TheLitigationChamber alsoconsidersthat thecurrent versionof the
TCF does not facilitate the exercise of the rights of data subjects, especially in view of thejoint
processingresponsibility of thepublisher, theimplementedCMP and the defendant. The
Geschi'llenkamer also underlines that the AVG requires data subjects to be able to
exercise their rights vis-à-vis each of the joint processing controllers in the TCF in order to
comply with orfi/re/en 24 and 25 of the AVG. In view of the foregoing, the Disputes
Chamber finds that the Respondent has breached its obligations in the areas of security
of , integrity of personal data and data protection by design and default settings (Article 24,
Article 25, Article 5.1.f, and ortiLe/ 32 of the AVG).
F, in order to comply with Articles 24 and 25 of the AVG. In view of the foregoing, the
Disputes Chamber finds that the Respondent has breached its obligations in the areas
security of processing, integrity of personal data and data protection by design and
default settings (Article 24, Article 25, Article 5.1.f, Article 32 uan the AVG).
PAGE 01-D0004384135-0052-0071-02-02-
L -J Brusselsurt ofAppeals- 2022/AR/292 - p53
• Article 30 AVG - As "explained above, "the Dispute Resolution Chamber cannot follow the
Defendant's argument that it can' qualify for the exceptions to the obligation to a register of
processing activities" provided for in Article 30.5 AVG. Because the Defendant's register of
processing activities does not include any processing operations relating to the TCF, except
for the management of members as well as the administration of the TCF, although IAB
Europe, as Managing Organization, can access ele records of consent, the GK finds a violation
of Article 30 AVG.
• Article 35 AVG - Taking into account the large number of data subjects who come into
contact with websites and applications implementing the TCF, as well as organizations
participating in the TCF, on the one hand, and the impact of the TCF on the large-scale
processing of personal data in the OpenRTB protocol, on the other hand, the Litigation
Chamber that IAB Europe has failed to a comprehensive data protection impact assessment
(GE-B) with respect to the processing of personal data within the TCF. The Litigation Chamber
finds that the TCF was developed, among other things, for the RTB system, which"
systematically and automatically observes, collects, records or influences users' online
behavior, including for advertising purposes. Likewise, it is not disputed that within the
OpenRTB, data are widely collected from" third parties (DMPs) in order to analyze or predict
the economic situation, health, personal preferences or interests, reliability or behavior,
location or movements of natural persons.
•Article 37, AVG - Because of the large-scale, regular and systematic observation of
identifiable users that the TCF entails, and given the defendant's role, specifically its capacity
as Managing Organization, the Dispute Resolution Chamber finds that IAB Europe should
have appointed a Data Protection Officer (DPO). By failing to do so, the Defendant' is in
breach of Article 37, AVG."
EIGHTH GRIEF IAB Europe : The Contested Decision wrongly concludes that IAB Europe needs a
legal basis and that no legal basis exists for the processing of TC Strings and OpenRTB data.
(violation of Articles 5.1.a and 6 AVG)
EighthdefenseGBA,partsixthpleacomplainants.
Summary views of parties
the processing of TC Strings, IAB Europe argues that the Contested Decision recognizes that they are
processed by the CMPs and that the CMPs are jointly responsible with IAB Europe for that
processing ; consequently, at least the shouldalso be heldresponsible forheepossiblelackofalegal
basis,andnot(only)fABEurope.Moreover, the Dispute Chamber would not have examined whether
CMPs, in their user interface
PAGE 01-0000j384135-0053-0071-02-02-4 Court of Appeals Brussels -2022/AR/292 - p54
seek consent from the data subject to record their consent, objections and preferences. IAB Europe
draws the conclusion that the Contested Decision cannot find that consent has not been obtained.
Finally, IAB Europe considers the balancing of interests regarding the (lack of a) legitimate interest
within the meaning of Article 6, first point (f) AVG (margin numbers 421-423 of the Contested
Decision)tobewrong.
The GBA argues that IAB Europe, in its capacity as a data controller, requires a legal basis for the
processing of TC Strings by CMPs, but there is no such legal basis. IAB Europe therefore violated
Article6AVG.
According to the complainants, IAB Europe's processing of personal data in the TCF violates the
basic principle of fair, lawful and transparent processing. Indeed, it does not have any legal basis
for the processing, has obtained the personal data in a misleading way, and does not provide
either the complainants or any other data subjects with the legally required information about the
processing of personal data it carries out (violation of Articles 5, 6, 12, 13 and 14 AVG).
Judgment of the Market
Court82.
Article 5(1)(a) AVG states that all processing of personal data must be carried out in "a manner
which lawful, decent and rronsporont in relation to the data subject."
The "rechtfmot/g" nature of a processing operation essentially means that it must meet àll legal
requirements, in particular having a legal basis.
Since IAB Europe does not provide any information about the processing of personal data to data
subjects, data subjects are left guessing as to which legal basis provided for in Article 6 AVG IAB
EuropewouldinvokeforitsprocessingofpersonaldataintheTCF.
However, it cannot on any legal basis under Article 6 AVG for the processing of the TC String in the
TCF. Moreover, the Litigation Chamber correctly states that IAB Europe cannot suffice merely by
to subsequent notifications that might be made to data subjects by Publishers or Publishers.
83.
IAB Europe cannot rely on the consent of complainants and other data subjects (Article 6(1)(a)
AVG), as it never sought, let alone obtained, such consent. Also nowhere in the TCF Policies,
Technical Specifications or General Terms and Conditions is a mechanism
PAGE 01-000D43B4135-D054-DD71-02-02-4
L y Court of Appeals Brussels -2022/AR/292 - p55
cited where IAB Europe would ask "data subjects permission to cure a uniquely-identifying string
that shares their privacy preferences with a very large number of recipients. This lack of consent
is even more egregious when those data subjects indicate in a CMP that they do not want to
share personal data with anyone.
The Disputes Chamber was correct to find in the Contested Decision that nowhere does IAB
Europe obtain consent to process the personal data in the TCF, with in particular the TC String
(edge number 407 of the Contested Decision).
84.
IAB Europe also cannot rely on the necessity of the processing of the TC String within the TCF for
the performance of a contract with the Complainants and other data subjects (Article 6(1)(b)
AVG), as there is no contract at all between them and IAB Europe. Therefore, the Dispute
Chamber correctly established this in the Contested Decision (margin number 408 of the
Contested Decision).
85.
Nor can it rely on the necessity of the TC String's processing operations within the TCF to comply
with a legal obligation incumbent upon it (Article 6(1)(c) AVG), or protect the vital interests of
the complainants and other data subjects (Article 6(1)(d) AVG), or in the performance of a task
carried out in the public interest (Article 6(1)(e) AVG), as none of these justifications are present in
the matter.
86.
Finally, Zi) also cannot rely on the necessity of the TC String's processing operations within the
TCF to protect its legitimate interests, or those of a third party (Article 6(1)(f) AVG). Indeed, the
Dispute Chamber did the balancing of interests in the Contested Decision and rightly found that
the conditions for an application of Article 6(1)(f) AVG are not met. IAB Europe - on whom the
burden of proof of lawful data processing rests - did not provide sufficient insight into the
considerations it made and the factual data relevant in this respect. The conclusion is therefore
that it has not been established that the processing of personal data within the TCF is necessary
for a legitimate interest of IAB Europe or its members. IAB Europe does not sufficiently
recognize that users have a right to and an interest in the protection of their privacy and personal
data, and that the processing of personal data for advertising purposes may this. Furthermore, as a
data controller, it must take into account the reasonable expectations of data subjects. No
document submitted to the Court showed that IAB Europe actually so.
87.
PAGE 01-0000# 36# 13 S-00 S 5-0071-OZ-0Z- 1 Court of Appeals Brussels -2022/AR/292 - p56
The analysis related to the g lack of a legal basis in the Contested Decision is not incoherent as
IAB Europe argues. Moreover, the Dispute Chamber did not make its analysis in the abstract but
rather applied it in a concrete manner.
The Contested Decision is correctly reasoned as to the lack of a legal basis on the part of IAB
EuropeforitsprocessingofpersonaldataintheTCF.
IABEurope'seighthgrievanceisthereforeunfounded.
NEGTH GRIEF IAB Europe : The Dispute Chamber erroneously concludes that IAB Europe hasfailedto
complywithits
violatesdutyoftransparency(§§465-473).
NinthdefenseGBA,partsixthpleacomplainants.
Summaryviewsofparties
IAB Europe disputes the Dispute Chamber's opinion in the Contested Decision according to which it
violates the transparency obligation in Articles 12, 13 and 14 AVG. First, the Contested Decision
would not have investigated and identified the defective disclosure on its own. Second, any
information not provided by IAB Europe could and should be supplemented by the CMPs and
publishers. Third, IAB Europe opposes the finding that the large number of third-party recipients
makes it impossible for data subjects to give informed consent to processing and thus violates the
principleoftransparency.
According to the GBA, the lack of disclosure was convincingly demonstrated by the complainants
and additionally relies on the Technical Report of the Inspection Service.
As for the obligation to compliance with the obligation of transparency, this rests on the data
controller, being IAB Europe and cannot be passed on to the CMPs and publishers. The Dispute
Chamber's factual assessment does not appear manifestly unreasonable. It is irrelevant whether
the consent preferences were already encoded in a TC String or encoded, given that also the
making available of such personal data qualifies as processing according to Article 4 AVG and the
data subject must therefore be informed about it.
Where the Contested Decision establishes a breach of the obligation of transparency, the
lawfulness of the Contested Decision cannot be affected if the reasoning were incorrect. Indeed,
the violation rests on several findings, only one of which is by IAB Europe. In any event, even if
the TCF is only a minimum framework, it must still be in compliance with the AVG.
PAGE 01-00004384135-0D56-0071-02-02-4
L -J Court of Appeals Brussels -2022/AR/292 - p57
According to the Complainants, IAB Europe has breached its duty of transparency as a data
controller, and the Dispute Resolution Chamber correctly relies for this conclusion on a thorough
analysis of IAB Europe's own TCF documentation (e.g., margin numbers 467-473 of the
Contested Decision).
JudgmentoftheMarketCourt
88.
TheMarketsCourtfindsthattheContestedDecisioncorrectlymakesthefollowingfindingsbased on
the documents prepared by IAB Europe itself.
Neither on its own website nor in other sources does IAB explain stakeholders such as complainants
ortheGBA as a supervisory authority :
That IAB Europe is (joint) controller for the TCF and what its contact details are ;
2. What are the contact details of its data protection officer (which IAB Europe should
appoint, as the lnspectorate also noted in its report, given its essential activity and role
within the TCF) ;
3. what its processing purposes are and the legal basis for the processing (which, by the
way, it does not have at all in this case, see above) ;
4. Whatcategoriesofpersonaldataitprocesses(inparticular,theTCStringj;
5. Whoallreceivesthepersonaldata(thisalreadyincludesatleastallTCFparticipantswho
receive the TC String) ;
6. Whetheritintendstotransferthepersonaldatatorecipientsinthirdcountries;
7. howlongpersonaldatawillbekept;
8. Whataretherightsofdatasubjects;
9. ThatdatasubjectsmaylodgecomplaintswiththeDataProtectionAuthority;
10. Thatdatasubjectscanrevoketheirgivenconsentsagain;
11. Whatthesourceofthepersonaldatais.
89.
IAB Europe's own privacy policy on its website (piece B.18 complainants) cannot remedy this.
Indeed, IAB Europe makes it clear that its privacy policy applies to only a limited number of data
subjects :
"IAB Europe respects the privacy of the visitors on its websites ("Websites") ("Users"), its
registered members ("Members") to which it provides services as further specified in the
General Terms of Use ("Services") and of Transparency & Consent Framework participants
/"7CF Participants"). In this Privacy Policy, references to Members or TCF Participants
mean both individual Members or TCF Participants and individuals who are employed by
corporate
PAGE D1-00004384135-0D57-0071-02-02- Members or TCF Participants. This Privacy Policy is also addressed to individuals outside
IAB Europe involved in the public debote concerning digital advertising, with whom IAB
Europe may interact and whose personal data it processes ("Stakeholders")."
OrinDutch(noofficialtranslationknown):
"IAB Europe respects the privacy of visitors to its websites ("Websites") ("Users"), of its
registered members ("Members") to whom it provides services as further specified in the
General Terms of Use ("Services") and of participants in the Transparency & Consent
Framework ("TCF Participants"). In this Privacy Policy, Members or TCF Participants refers
to both individual teden or TCF Participants and individuals employed by member
companies o] TCF Participants. This Privacy Policy is also addressed to individuals outside of
IAB Europe who are involved " the public debate on digital advertising, with whom IAB
Europe may communicate and whose personal data it processes ("Stakeholders")."
None of the categories of data subjects mentioned in this quote relates to data subjects whose
personal data is processed in the TCF when they express certain preferences through a CMP and a
TC String is generated for them. Consequently, the2nd privacy policy is not relevant in this case
and cannot be considered in assessing whether IAB Europe has complied with its transparency
obligation.
Accordingly, IAB Europe violates Article 5(1)(a), Article 12 and Article 14 AVG, as the Dispute
Chamber was entitled to find in the Contested Decision.
90.
IAB Europe did not inform data subjects prior to the processing operations. At the same time, it
cannot invoke any of the exceptions provided for in Article 14S) AVG in order not to have to provide
this information, since '
• the data subjects do not yet have the information, since the processing operations with
respect to them have so far been carried out without any transparency (Article 14(5)(a)
AVG) ;
• it is neither impossible nor requires a disproportionate effort to disclose this information
to data subjects, given IAB Europes influence over the operation of the TCF (Article
14(5)(b) AVG) ;
• Obtaining this data is not required by law (subsection 14(5)(c) AVG) and
• the personal data should not remain confidential by virtue of professional secrecy (Article
14(5)d) AVG).
PAGE 01-00D04384135-0058-0071-02-02- BrusselsCourtofAppeals-2022/AR/292-p59
The Contested Decision is correctly reasoned on the issue of lack of transparency on the part of IAB
EuropeforitsprocessingofpersonaldataintheTCF.
IABEurope'sninthgrievanceisthereforeunfounded.
TENTH GRIEF IAB EUROPE : The Contested Decision erroneously concludes that tIAB Europe)
violated its obligations regarding security, Integrity and data protection by design and default
settings (§§477-494).
TenthdefenseGBA,fifth,seventhandeighthpleascomplainants.
sSametvatain anten aden
IABEuropearguesthatitisnotsubjecttotheaccountabilityobligationunderArticle24AVG,nortothe
data protection obligation under Article 25 AVG, as it does not qualify as a data controller. Nor
does it believe that it is obliged to enforce compliance with the TCF by the organizations
participating in it, as it would merely be a private law agreement and, moreover, it would not be
data controller. Finally, IAB Europe also disputes that it would bear any responsibility for any
internationaltransfersofdata,assuchtransfers outsidethescopeofthe TCF.
In subordinate order, IAB Europe argues that, even if it were accepted that it is a joint data
controller with publishers and vendors, the AVG does not require it to supervise what are, in that
caseco-controllers. In addition, it accuses the Dispute Resolution Chamber of failing to provide
evidence that the TCF's security is inadequate and does claim to so-called validation.
The GBA argues that IAB Europe, as a data controller, is subject to the obligations In Article 24(1)
; Article 5(1)(f) ; Article 32 and Chapter V of the AVG and that IAB Europe breached the security
obligation.
Also according to the complainants who support the GBA's position, IAB Europe does not have
an adequate protection mechanism. For example, IAB Europe does not specify how it would
then ensure that CMPs effectively do not cooperate with Publishers who do not comply with the
agreements made. All it claims is that the "mechanisms for compliance in the TCF would ."
However, how this is supposed provide real protection is a to complainants. Indeed, none of the
mechanisms are based on real, proactive monitoring of TCF compliance. It is totally unclear to the
complainants how IAB Europe could guarantee the security of the processed TC String at all when
shared with the thousands of receiving companies.
Judgment of the Market Court
PAGE 01-00004384135-0059-0071-02-02-4
L Brussels Court of Appeals - 2022/AR/292 - p60
91.
The Market Court refers to what precedes and the correct assessment by the Dispute Resolution
Chamber in the Contested Decision of IAB Europe as (joint) controller of personal data processing
in the context of TCF.
92.
The starting point is that in order to protect the rights and freedoms of data subjects and the
responsibility and liability of data controllers, it is necessary that the responsibilities established by
the AVG be allocated in a clear manner (the mutual arrangement to be adopted by joint
controllers under Article 26 AVG, which is not before us in the present case). The allocation of
responsibilities is thus a matter for the joint controllers themselves, taking into account, on the
one hand, the need for full compliance with the AVG and, on the other hand, the undesirable
complexity (which could lead to a breach of the principles of lawfulness and transparency from
Article51)AVG).
The Market Court has already held above that the absence of a mutual arrangement or evidence
thereof and the fact that both IAB Europe and the parties processing personal data with it under
the TCF are all large or significant personal data processors (and thus by no means small entities
with little influence over processing operations), implies equal convergent responsibility hero in
this particular case.
This is appropriately expressed by the Dispute Chamberin the Contested Decision at margin number
371in the following manner :
"Accordingly, the Dispute Resolution Panel finds that IAB Europe and the respective
participating organizations should be regarded as jointly responsible for the collection and
subsequent dissemination of users' consents, objections and preferences, as well as for
the related processing of their personal data, without, however, the responsibility
participating CMPs and adtech vendors detracting from the responsibility of IAB Europe."
As already held above, IAB Europe does qualify as a (joint) controller of TC Strings' processing
under the TCF.
Consequently, it has both an accountability obligation (Article 24(1) |uncto Article 5(2) AVG) and a
security obligation (Article 32 AVG |uncto Article 5(1)(f) AVG).
PAGE 01-0000938q135-0060-0071-02-02-4
L -J Brussels Court of Appeals - 2022/AR/292 - p61
93.
IAB Europe is also a data controller with respect to TC Strings that would be by CMPs outside the
EEA. On this point, IAB Europe argues that the TCF was explicitly not developed for international
transfers by publishers, vendors and CMPs. However, that is not a relevant criterion under the
AVG. IAB Europe has been identified as a controller of TC Strings under the TCF because it
appears to determine the purposes and means of processing the personal data contained in the
TC Strings. As a controller, it, like the processor(s), is obliged under Article 44 AVG to comply with
the conditions in Chapter V of the AVG before transferring these personal data to a third
country.
94.
IAB Europe further maintains that the TCF itself is contractual in nature. But this contractual
nature does not at all prevent IAB Europe from requiring, in accordance with Article 24(1) AVG,
"appropriate technicalandorganizationalmeasures(to)ensureandbeabletodemonstratethat the
processing is carried out in accordance with (the AVG)." it goes without saying that if the
existence of an agreement between joint controllers were sufficient to escape this obligation,
Article 24(1) AVG would be deprived of any useful effect.
The Contested Decision does provide evidence of a lack of security. It substantiates this by
reference to a recent academic paper which IAB Europe claims one of the complainants contributed
to" and further deduces this from the fact that the TCF Policy does cite the possibility of
falsification or alteration of the TC Strings but merely stipulates that such manipulation is not .
Accordingly, it fell to IAB Europe to produce before the Dispute Resolution Chamber or the Market
Tribunal any relevant document that could demonstrate the contrary, quod non.
IAB Europe claim to provide a so-called validation, but it is a one-time, prior validation of the
software used by CMPs to generate the TC Strings. This validation primarily prevents CMPs from
generating unreadable, incorrect or non-TCF-compliant TC Strings.
The Contested Decision, on the other hand, correctly points out the lack of validation of
individual TC Strings. Only such validation can prevent vendors from (potentially) falsifying user
consent.
" C.SANTOS,M.NOUWENS,M.TOTH,N.BIELOVA,V.ROCA,"ConsentManagementPlatformsUnderthe
AVG:Processorsand/orControllers?",inPrivacyTechnologiesandPolicy,APF2021,LNCS,vol12703,
Springer,2021.TheMarketsCourtfindsthatanycontributionbyacomplainant doesnotundermine the
neutralityorqualityofanacademiccontribution.
PAGE 01-00004389135-0061-0071-02-02-4
L Brussels Court of Appeals - 2022/AR/292 - p62
The Contested Decision is correctly reasoned on the issue of violations of security, integrity and
dataprotectionobligations bydesignanddefaultsettingsonthepartIABEuropefor its processing of
personaldataintheTCF.
IABEurope'stenthgrievanceisthereforeunfounded.
ELFTH, TWAALFTH, THIRTEEN and FOURTH GRIEF IAB Europe : [IAB Europe) does not need to makeany
data protection impact assessment §§ 511-516 of the Contested Decision), [IAB EuropeJ is not
required to appoint a data protection functlonary (§§ 517-524), [IAB Europe] does not have a
legal obligation to facilitate the ultimation of data subjects' rights (§§ 504-506) and [IAB Europe)
Is not required to have a register of processing actlvitiesand in any case this Is not incomplete (§§
507-510).
EleventhdefenseGBA.
Summaryviewsofparties
By its el(de to 14th grievance, IAB Europe disputes that it is required to conduct a data protection
impact assessment under Article 35 AVG, appoint a data protection officer under Article 37 AVG,
keep a register of processing activities under Article 30 AVG, and facilitate the exercise of data
subjects' rights under Articles 1S-22 AVG.
AccordingtotheGBA,itispertinentlyincorrectthatIABEuropewould onlyprocess personaldataof
its staff and of applicants, members and suppliers. It also argues that in order to qualify as a data
controller, it in no way requires that a person have access to the personal data in question. Nor
does it argue that Articles 30, 35 and 37 AVG make this a condition for the obligation to conduct a
data protection impact assessment or appoint an officer. Without the TCF, according to the GBA,
the processing of personal data in the context of RTB would simply be prohibited, as no consent
can be obtained or demonstrated for these (lightning-fast) processing operations. For that reason
alone - the GBA argues - it is "mischievous" to claim that the TCF protects Internet users, rather
than exposes them to the mass exchange of their personal data.
PlaintiffsendorsetheGBA'sposition.Judgment
of the Market Court.
Ontheobligationtoconductadataprotectionimpactassessment(Art. 3s AVG).
95.
PAGE 01-00004384135-0062-0071-02-02-4
L Brussels Court of Appeals - 2022/AR/292 - p63
Having reviewed the Contested Decision and documents submitted to it (including the reports of
the Inspectorate, document A133 file GBA), the Market Court cannot follow IAB Europe's
argument that it can benefit from the exceptions to the obligation to a register of processing
activities provided in Article 30(S) AVG. Since IAB Europe's register of processing activities does
not contain any processing operations in relation to the TCF, except for the management of the
teden as well as the administration of the TCF, although IAB Europe, as Managing Organization
or management organization, can access the records of consent (as above), the Dispute Chamber
correctly finds a violation of Article 30 AVG in the Contested Decision. This was rightly expressed
much earlier by the Inspectorate as follows :
"The Inspectorate considers that ter non communication by IAB Europe of its register of
processing activities following its request of 04/06/2019 (Exhibit No. 18 of file DOS-2019-
01377) is in contradiction with the provisions of Article 30(4) of the AVG. Moreover, IAB
Europe's position that it" does not have to keep records of processing activities" is in srryd mel
orti#e/ 30(5) von the AVG and with let position of the ECGB."
96.
Considering the large number of data subjects who (may) come into contact with websites and
applications the TCF, as well as organizations in the TCF, on the one hand, and the impact of the
TCF on the large-scale processing of personal data in the OpenRTB Protocol, on the other hand,
the Dispute Chamber rightly finds in the Contested Decision that IAB Europe wrongfully failed to
conduct a comprehensive data protection impact assessment with respect to the processing of
personal data within the .
About the obligation to wiiien a data protection officer (Art. 37 AVG).
97.
Because of the large-scale, regular and systematic observation of identifiable users that the TCF
entails, and given the role of IAB Europe, as Managing Organization, the Dispute Resolution
Chamber correctly finds in the Contested Decision that IAB Europe should have appointed a Data
Protection Officer (DPO). By failing to do so, IAB Europe violated Article 37 AVG. This was also
substantiated in the Inspectorate's report (Exhibit A133 file GBA):
"The Inspection finds that IAB Europe has not complied with the obligations of Article 24(1)
of the AVG. 0e reasons for this vostste/ling are the 'following: In its replies oon the
inspectorate dated 26/06/2019 (Exhibit No. 22) and 20/08/20J9 (Exhibit No. 29), IAB
Europe states that "IAB Europe is a professional association whose main activities are the
provision of information and tools to stakeholders (in particular companies) active in the
digitaladvertisingsector,aswellastheprovisionofinformation
PAGE 01-00D04384135-0063-0071-02-02-
L J CourtofAppealsBrussels-2022/AR/292-p64
to the general public to verbalize their knowledge and inform them about the value that
digital advertising for the market. Since IAB Europe did not meet the conditions referred to
in Article 37 §1(b) of the AVG, it" did not appoint a data protection officer."
According to the lnspectorate, IAB Europe's approach set out above is not by the facts. The
conditions of Article 37(1)(b) of the AVG are , since IAB Europe develops and manages the
TCF in its capacity as " Managing Organization " Exhibits 32 and 38 of file DOS-2019-01377)
and pursuant to page 7 of the terms and conditions for the IAB Europe Transparency &
Consent Framework of IAB Europe ("Terms and ConditionsJ ("General Terms and
Conditions "J (piece 33 of file DOS-2019-01377)) has a right to access, store and process
any information by the organizations inthisecosystem,statedinits"PrivacyPolicy."
In so far as the Contested Decision rules on the breach by IAB Europe of the obligations on data
protection impact assessment, on the appointment of a data protection officer and on the
maintenance of a register of processing activities, as regards its processing of personal data in the
TCF, it is correctly reasoned.
98.
This is also the case for the following passage in the Contested Decision that deals with the alleged
violations regarding the rights of data subjects (Articles 15 to 22 AVG):
"504. First of all, the lnspectorate notes in its report that certain complainants have
alleged that it is impossible for those concerned to exercise their rights, although the
investigation conducted by the Inspectorate did not these violations. In the absence von
bewiys von an infringement, the Dispute Chamber limits its reasoning to general
commentsregardingtheexerciseoftherightsofdatasubjects.
505. Second, the Dispute Chamber refers to the scope of the Complainants' written
submissions, in which they" specifically limited their grievances tof the processing of the
Complainants' personal data by the Respondent in the specific context of the TCF. Bj
"consequence, the Disputes Chamber will niec adjudicate the circumstances in which data
subjects can exercise their rights with respect to the processing of personal data in the "bid
requests" vis-à-vis the adtech vendors, since this processing is carried out entirely in
accordance with the OpenRTB protocol.
506. With respect to the current version of the TCF, however, the Dispute Chamber finds
that the TCF does not appear to facilitate the Exercise of Data Subjects' rights, in that users
cannoteasilyandatalltimes theCMPinterface,sothat
PAGE 01-00004384135-0064-0071-02-02-4
L CourtofAppealsBrussels-2022/AR/292-p65
they can change their preferences and request the identity of the adtech vendors with whom
their personal data have been shared through a bid request, in accordance with the OpenRTB
protocol. In this regard, the Litigation Chamber underscores the importance of proper
implementation and enforcement of the interface requirements set forth in the TCF Policies
so that data subjects can effectively exercise their rights vis-à-vis each of the joint processing
responsibilities, and notes" that the shared responsibility for this lies primarily with the CMPs
and publishers. Based on the govensroonde, the Disputes Chamber is not In a position to find
a breach uast of Articles 15-22 AVG."
IAB Europe's 11 , 12 , 13 ' and 14th grievances are therefore
unfounded. THE ORDERS AND FINE !N THE CONTESTED
99.
IABEuropedoesnotdevelopaseparategrievanceinitsconclusionregardingtheinjunctionsimposed
onitandthe administrative fine.
100.
In margin number 353 of its conclusions, IAB Europe states :
"S53. Destruction of the fine - In addition, it should be emphasized that in calculating the fine
in the Contested Decision, no distinction is made between the various alleged breaches of the
AVG and their impact on the amount of the fine for [IAB Europe]. However, it is clear from the
CJEU Judgment that they/s the Contested Decision as such does not contain sufficient
justification for a huge proportion of the alleged infringements. As indicated earlier, five of
the six infringements in the Contested Decision are based on (IAB Europe's) alleged
processing responsibility for subsequent processing. However, it is clear from the CJEU
Judgment that there is no processing responsibility on the part of [IAB Europe] for subsequent
processing by third parties. This means that at least B0% of the Contested Decision is based on
an erroneous assessment of the factual and legal facts of the case.
This already suffices as a circumstance to substantially reduce the fine (should a fine be
justified - quod non, as further explained below).
Moreover, in accordance with the case law of the Court of Justice ,an administrative fine
can only be imposed "if it is established that the , which is both a legal person and an
undertaking, has intentionallyornegligently an infringementreferredto inparagraphs 4to6
ofthatArticle(83AVG)."
PAGE D1-D00D4384135-0D65-0071-02-02-4
L y In this case, [IAB Europe] certainly was not and cannot be accused of intentional wrongful
conduct. Even in the Contested Decision, negligence was only alleged but not
demonstrated and then only with respect to the integrity of the TC String (§547 Contested
Decision). In light of the above-mentioned case law, only a can be imposed in proportion
to the negligence established. In practice, [IAB Europej has already taken the necessary
steps öithin the limits of its role - as a non-processing responsible party - to promote
compliance with the AVG by TCF participants.
The lack of negligence (and deliberate unrec/itmoric behavior) is all the more obvious
since fundamental questions to the CJEU have been raised on which the entirety of the
case depends, even if it was first proposed to your Court by the Litigation Chamber itself.
Asking questions to the CJEU clearly shows that a certain legal question is pertinent and
thatthereisnouniqueandmanifestlyclearanswer(yet).
Consequently,theimpositionofanadministrativefinewasnotjustified."
The GBA and the complainants' briefs no longer address the injunction and the administrative
fine imposed.
JudgmentoftheMarketCourt
101.
Article 58(2) AVG provides the power for supervisory authorities to take one or more corrective
measures against controllers or processors.
Under Article 58(2)(i) AVG, a supervisory authority may, depending on the circumstances of
each case, impose an administrative fine in addition to or instead of the aforementioned
corrective measures.
102.
In this regard, Article 83(1) AVG requires that an administrative fine imposed by an authority must
effective, proportionate and dissuasive in each case. Article B32) AVG contains a number of
criteria that must be duly taken into account in a concrete case.AsanctiontobebytheGBAinthe
form of an administrative fine must be adequately justified, whereby the size of this sanction must,
on the one hand, be in line with the circumstances and, on the other hand, be proportionate to the
breach identified and to the capacity of the offending party to bear the costs.
103.
PAGE 01-00004384135-0066-0071-02-02-4
L -J A fine of a criminal nature should be subject to judicial review with full jurisdiction."
To determine whether or a sanction is criminal in nature within the meaning of Article 6 ECHR,
the Court the so-called Engel'' criteria.
TherearethreeEngelcriteria:
— thequalificationofthesanctionintheinternallawofthestateconcerned;
— Thenatureoftheviolationforwhichthepenaltyisthreatened;
— Thenatureandseverityofthemaximumpenaltythattheindividualrisks.
The three criteria are not cumulative. Even if a sanction does not have the qualification of
criminal sanction under domestic law, it may still have a criminal under the second or third
criteria."
In order for an administrative fine to have a preventive and punitive purpose, it is required that it
essentially seeks to prevent and punish an act or omission deemed illegal by the legislature and
thatthefinethuscausessufferingtotheperpetratorofthatactor omission. 20
104.
When the Market Court is asked to review an administrative fine that is punitive in nature within
the meaning of Article 6 ECHR, it may examine the legality of that sanction and, in particular,
whether it is reconcilable with the mandatory requirements of international treaties and
domestic law, including general principles of law.
In particular, this right of review should allow the Court to consider whether the penalty is not
disproportionate to the infringement, so that it may examine whether a fine of such magnitude
could reasonably be imposed.
This right of review does not mean that the Market Court may, based on a subjective
appreciation of what it deems reasonable, for mere expediency and against statutory rules,
remit or reduce a fine."
'* ECHR 4 March 2004, Silvester's Horeca Service v. Belgium, no. 47650/99, RO 27 and ECHR 4 March 2014,
Grande Stevens v. Italy, no. 18640/10, RO :t39.
" Named after the ECHR judgment June 6, 1976, Engel v. Netherlands. "
See Cass. Sept. 23, 2022, concl. J. Van der Fraenen, wwwJggrLtao be. '
See Cass. June 2, 2023, F.22.0005.N, concl, S. Ravyse, www.¡uportaI.be.
21 SeeCass.June17,2024,C.23.0144.N .iuportaIbe.
PAGE 01-00004389135-0067-0071-02-02-4 Brussels Court of Appeals - 2022/AR/292 - p.
68
105.
Thecourtconsidersthatthefineof 250,000.00imposedbytheGBA,givenitsamount,iscriminalin
naturewithinthemeaningofArticle6(1)ECHR.
106.
On October 11, 2021 (document A179 file GBA), the Dispute Resolution Chamber of the GBA
made clear to IAB Europe its intention to impose an administrative fine and, in accordance with
the indications of the Market Court, asked IAB Europe to submit its reaction in this respect. IAB
Europe therefore had the opportunity to specifically defend itself with regard to the fine, which it
did (document A180 file GBA).
107.
Indeterminingthefine,theGBAconsideredthefollowingcircumstances(Exhibit A179 file GBA) '
• "IAB Europe is a trade association whose main activities are said to be the provision of
information and tools to stakeholders (in particular companies) active in the digital
advertising sector in the European Union as well as the provision of information to the
general public to improve their knowledge and inform them of the value of digital advertising
to the market. The defendant therefore has a leading role in relation to its members as well
as to the wider digital marketing and advertising sector in the European Union."
• "IAB Europe is part of the IAB Global Network as well as von the lnteractive Advertising
Bureau (IAB) consortium, based in New York."
• "IAB Europe's TCF, in its current version, aims to be used in an increasing number of
websites and applications, which means that more and more data subjects will be confronted
with the TCF and the associated processing of their personal data."
It also took into account the following criteria : a) nature of the infringement, b) seriousness of
the infringement, c) duration of the infringement and d) the necessary deterrent effect to
prevent further infringements.
108.
IAB Europe essentially accuses the GBA of failing to consider the lack negligence (and intentional wrongful
conduct).
109.
However, in the Contested Decision (margin number 547), the Dispute Chamber specifically and
pertinently responds to this point that is now being raised again by IAB Europe before the
Market Court :
PAGE 01-00004384135-0068-0D71-02-02-'|
L Brussels Court of Appeals - 2022/AR/292 - p, 69
"Article 83.2.b AVG requires the Data Protection Authority to take into account the
intentional or negligent nature of the breach. Since the defendant, in its capacity as a
management organization, was aware uan the risks associated with non-compliance with
the TCF, in particular mer with respect to the integrity of the TC String and the
encapsulated choices and preferences of users, and given the impact of the TC String on
subsequent processing in the context of the OpenRTB, the Dispute Resolution Chamber
finds that IAB Europe has negligent in' adopting the measures to implement the current
version of the TCF."
TheContestedDecision(s)iscorrectlyreasonedonthispoint.
After review, the Court considers that, in view of the foregoing, the GBA Disputes Chamber could
reasonably impose a fine of EUR 250,000.00.
In conclusion, while the contested decision is admittedly procedurally flawed as set out in the
Interlocutory Judgment, IAB Europe's substantive grievances against the contested decision are
unfounded, except to the that the contested decision holds that IAB Europe acts as a (joint)
controller of the processing operations that take place entirely under the OpenRTB protocol.
The Market Court also confirms the sanctions imposed on IAB Europe by the Contested Decision
that relate solely to processing operations within the TCF. It is not necessary to refer the case
back to the Dispute Resolution Chamber, nor is it legally required for the Market Court to
proceed with a European consultation procedure.
ONCOSTSANDLEGALFEES
110.
The costs of the proceedings including a jurisdictional fee in the amount of EUR 7,848.84 (it
concerns an application to set aside a fine of EUR 250,000.00) (in accordance with the case law
of the Court of Cassation - Cass. January 23, 2023, C.22.0158.N and Cass. January 16, 2023,
C.21.0193.F - the Market Court automatically adjusts the rate to that applicable at the time of
thejudgment)fortheGBAshallbebornebyIABEurope,beingthelargelyunsuccessful party.
IABEuropeisalsoresponsibleforrolerightsandBudgetcontributions.
Since the plaintiffs are only intervening in the present proceedings as voluntary intervenors
(custodial intervention), they cannot be ordered to pay, nor receive, a jurisdictional fee.
PAGE 01-00004384135-0069-0071-02-02-4
L J FORTHESE
REASONS,THE
MARKETSCOURT,
Decidingbyadversarialjudgment,
The administration of justice proceeded in accordance with the law of June 15, 1935 on the use of
languagein court proceedings,
therequesttoreopenthedebatesoriginatingfromIABEurope.Further
elaborating on the interlocutory judgment,
Annuls the Contested Decision only because of the procedural defects established in the
interlocutory judgment and thus, in particular, insofar as the GBA, without more, finds that TC
Strings are personal data within the meaning of Article 4(1) AVG and insofar as the GBA, without
more, in the Contested Decision appoints itself as the leading supervisory authority.
JudgedwithfulljurisdictionandafterPrejudicialJudgment,
Dismisses IAB Europe's substantive grievances against the Contested Decision as unfounded
except insofar as the Contested Decision finds that IAB Europe is acting as (joint) controller for the
processing operations carried out entirely under the OpenRTB protocol (a finding that the Market
Court does not endorse).
Notes that IAB Europe has committed infringements of the following provisions : Article 5(1)(a)
AVG ; Article 6 AVG ; Article AVG ; Article 13 AVG ; Article 14 AVG ; Article 24 AVG ; Article 25 AVG ;
Article 5(1)f) AVG ; Article 32 AVG ; Article 30 AVG ; Article 35 AVG ; Article 37 AVG, and this in
the manner set forth in margin number 535 of the Contested Decision except to the extent that
the Contested Decision finds that IAB Europe is acting as (joint) controller for the processing
operationscarriedoutentirelywithintheframework of the OpenRTB protocol.
ConfirmsthesanctionsimposedonIABEuropebytheContestedDecision.
Order IAB Europe to pay the costs of the proceedings, including the basic indexed amount of the
procedural indemnity of EUR 7 848,84 to the GBA.
PAGE 01-00004389135-0D70-0071-02-02-4
L y CourtofAppealsBrussels-2022/AR/292 p.71
Orders IAB Europe, pursuant to Article 269 of the Code of Registration, Mortgage and Court Registry
Fees,topaytotheBelgianState,theFPSFinances,thesumof 400.00forcourtfeesforappeals,and
todefinitivelytakechargeofthecontributionof EUR 24.00 fromtheBudgetaryFund.
iie
Thusstatedandpronouncedinopencivilhearingofthe ChamberAofthe
courtofappealinBrusselsonMay14,2025,
wherewerepresent:
A-M. WITTERS, Counseldd.Chairman,
C. TRANSFERS, Counsel,
A.BOSSUYT, Counselor,
S. THE Clerk,
COOMAN,
BOS UYT
E COOMAN
A-M.WITTERS
C. TRANSFER
PAGE 01-00004384135-0071-0071-02-02-4
L J
