Belgian data protection authorities are set to make a decision that could have far-reaching implications for the multibillion-euro online advertising market in Europe.
IAB Europe, an international digital marketing and advertising association, has been the subject of complaints about its approach to sharing data on the privacy preferences of individuals for the purposes of real-time auction for website advertising.
The decision is currently under review by the Belgian Data Protection Authority (APD) and is expected to result in a draft decision that would be reviewed by data protection authorities across Europe.
The ruling could impact the Transparency & Consent Framework (TCF), a “consent solution” designed to help online advertisers comply with the General Data Protection Directive and the EU’s ePrivacy Directive. when processing personal data or accessing or storing information on a user’s device. , such as cookies, advertising identifiers, device identifiers and other tracking technologies.
In a statement, the IAB said the DPA was close to identifying GDPR breaches in a draft decision. “He will also find that these infringements should be able to be corrected within six months of the issuance of the final decision, as part of a process that would involve the DPA overseeing the execution of a plan of action agreed by the government. ‘IAB Europe,’ he said.
According to the IAB, the draft decision states that it should be a legal data controller for “digital signals created on websites to capture the choices of data subjects regarding the processing of their personal data for advertising purposes, digital content and measurement “under the TCF. “The APD is supposed to treat these signals as personal data,” he said.
IAB Europe is also expected to be a joint controller for TC Strings in the specific context of OpenRTB, software commonly used in the online advertising industry to manage real-time bids for advertising on the Web.
“Based on the advice of other DPAs so far and the fact that IAB Europe does not in any way process, own or decide on the use of specific TC channels, as well as the relevant case law and its own interpretation of the GDPR, IAB Europe has not considered itself a data controller under the TCF.
“Therefore, it has naturally not fulfilled certain obligations of data controllers under the regulation. The draft decision will require IAB Europe to work with the DPA to ensure that these obligations are met in the future”, indicates the press release.
The global real-time auction advertising market could be worth up to $ 27.2 billion by 2024, growing by around 30% per year, according to some estimates.
A report from the Irish Civil Liberties Council says Google’s RTB system sends this data to 968 companies. He said a data brokerage company that uses RTB data to profile people influenced Poland’s 2019 parliamentary elections by targeting LGBTQ + people.
The report states that Google’s RTB system was used to target 1,200 people in Ireland profiled for drug addiction, diabetes and other health issues.
IAB Europe said it was optimistic about the possibility of forming an action plan under the oversight of the ODA which should allow the approval of the TCF as a transnational GDPR code of conduct by the DPA and the committee. European Data Protection Authority (EDPB).
But that might only be a result of the case, said Neil Brown, director of the virtual English law firm decodé.legal.
“It’s probably somewhere on a spectrum of the IAB that needs to make a change to its framework and all of the consent tools that are based on it changing slightly; until a little more transparency; up to larger or wholesale changes in the way this type of monitoring and surveillance is carried out; until I think a number of complainants want, that is, an end to this type of online tracking, “he said. ®