On Thursday 7 March, the Court of Justice of the European Union handed down a ruling (C-604/22) in which it clarifies the basic rules of the General Data Protection Regulation (GDPR) in the context of the auctioning of personal data for advertising purposes.
This ruling follows questions for a preliminary ruling referred by the Brussels Court of Appeal, before which an action was brought by IAB Europe, a non-profit association, which represents undertakings in the digital advertising and marketing sector at European level, which was challenging a decision by the Belgian Data Protection Authority.
IAB Europe had been criticised by the latter for presenting the solution it had drawn up for the user data auction system as in conformity with the GDPR.
This solution is based on a string composed of a combination of letters and characters grouped together in a ‘Transparency and Consent String’ (TC String), in which users’ preferences are encoded and stored, and which is shared with personal data brokers and advertising platforms so that they know to what the user has consented or objected.
Judging that IAB had been acting as a data controller without fully complying with the requirements of the GDPR, the competent Belgian authority imposed corrective measures and a fine on it in 2022.
In its judgment, the Court confirms that the ‘TC String’ contains information about “an identifiable user and therefore constitutes personal data within the meaning of the GDPR”.
It states that within the meaning of the GDPR, IAB Europe furthermore must be considered as a “joint controller” of data, as it “appears to exert influence over data processing operations when the consent preferences of users are recorded” and to determine, jointly with its members, “both the purposes of those operations and the means behind them”.
However, the Court concluded, IAB Europe could not be considered as a controller, within the meaning of the GDPR, in respect of data processing operations occurring after the consent preferences of users are recorded in a TC String.
See the judgment: https://aeur.eu/f/b72 (Original version in French by Thomas Mangin)