TCF not compliant with Article 6 of the GDPR, Belgian regulator rules

The Belgian Data Protection Authority (DPA) this week ruled that Transparency and Consent Framework (TCF) not compliant with Article 6 of the GDPR. IAB Europe fined in €250.000.

Belgian DPA stated IAB Europe, as Managing Organisation for the TCF, has failed to provide a legal basis for the processing of user preferences in the form of a TC String and has therefore breached article 6 GDPR. The BE DPA and gave two months to IAB Europe, to present an action plan to bring its activities into compliance.

Transparency and Consent Framework (TCF) is a mechanism that facilitates the management of users’ preferences for online personalised advertising.

BE DPA found stated that IAB Europe is acting as a data controller with respect to the registration of individual users’ consent signal, objections and preferences by means of a unique Transparency and Consent (TC) String, which is linked to an identifiable user, and that means that IAB Europe can be held responsible for possible violations of the GDPR.

The Belgian authorities say the decision was approved by all concerned authorities representing most of the thirty countries in the European Economic Area.

“The processing of personal data under the current version of the TCF is incompatible with the GDPR, due to an inherent breach of the principle of fairness and lawfulness. People are invited to give consent, whereas most of them don’t know that their profiles are being sold a great number of times a day in order to expose them to personalised ads. Although it concerns the TCF, and not the whole real time bidding system, our decision today will have a major impact on the protection of the personal data of internet users. Order must be restored in the TCF system so that users can regain control over their data” said Hielke Hijmans, Chairman of the Litigation Chamber of the BE DPA.

IAB Europe rejects the findings

IAB Europe rejected the findings and is considering all options with respect to a legal challenge. IAB Europe specifically says it is not the data controller of the TCF. IAB Europe states it will work with the BE DPA on the action plan.