According to the ECJ, the IAB’s Transparency and Consent Framework is not yet the answer to the digital advertising industry’s privacy problems. In its judgment of March 4, 2024, the European Court of Justice confirmed the interpretation of the Belgian Data Protection Authority, shedding light on the notion of indirectly identifying data, which falls under the definition of personal data.

In short, according to the ECJ, for data to qualify as personal data under GDPR, it is not necessary for that data, taken on its own, to enable the data subject to be identified directly. This interpretation is based on the idea that account must be taken of all the means reasonably likely to be used by the controller or any other person to identify the natural person, directly or indirectly.

Background:
▪️ IAB Europe is a non-profit association that developed the Transparency & consent framework (TCF), a framework of rules to ensure GDPR compliance when processing user personal data within the OpenRTB protocol for real-time bidding of advertising space on the internet.
▪️ The TCF simplifies user preference recording, by encoding them into a string called the Transparency and consent string (TC String), shared with data brokers and advertising platforms to know what the user has consented to or not. Additionally, a cookie is placed on the user’s device, which, when combined with the TC String, can be linked to the user’s IP address.

Ruling:
▪️ The TC String that captures a user’s preferences relating to that user’s consent to the processing of his/her personal data is considered personal data under GDPR. The ECJ recognizes that the TC-String, in itself, does not constitute personal data. It is only the possibility of associating it with another identifier that confers on the TC-String the status of personal data.
▪️ IAB Europe acts as joint controller. The ECJ considers that IAB Europe technically influences, for its own purposes (to promote the trading of online advertising space through real-time bidding), the processing operations of personal data and thus jointly determines with its members the purposes of such operations.

To read the ruling: https://lnkd.in/e-qgehXG