Belgian DPA sends its draft decision in the IAB Europe case to European counterparts

---

In 2019, the Belgian DPA received a series of complaints targeting Interactive Advertising Bureau Europe (IAB Europe). As the complaints concerned the same entity and related to the same subject, the BE DPA decided to handle the complaints (as well as investigations carried out by the Inspection Service of the BE DPA on its own initiative) as one single case. The complaints questioned the conformity of the so-called TCF (Transparency & Consent Framework) with the GDPR. The TCF, developed by IAB Europe, aims to contribute to the GDPR compliance of the OpenRTB protocol, which was created by IAB Tech Lab.

The Open RTB protocol is one of the most widely used Real-Time Bidding protocols. “Real-Time Bidding” refers to the use of an instantaneous automated online auction for the sale and purchase of online advertising space on the internet.

Given the cross-border nature of the TCF, the BE DPA, as the lead authority in this case, has shared at the beginning of this week its draft decision with other concerned European supervisory authorities, as foreseen under article 60.3 GDPR. 27 of them have indicated their willingness to be involved in the procedure as concerned supervisory authorities, which is a clear indication of the importance of the matter. The draft decision was uploaded on the European IMI system, in which they will be able to access the document and provide feedback within a period of 4 weeks.

As for the further procedure, two scenarios are possible :

• The concerned authorities express no relevant and reasoned objection to the draft decision, in which case the decision can be finalized as such.
• One or more of the concerned authorities express a relevant and reasoned objection to the draft decision (article 60.4 GDPR), in which case :
  • either the BE DPA will submit a revised version of the draft to its European counterparts, taking this objection into account ;
  • or, the BE DPA will not consider the objection reasoned or relevant, which could trigger the dispute resolution mechanism under article 65 GDPR.

Given that the cooperation procedure is confidential, the BE DPA will not be able to further comment on the decision nor the procedure at this time. At the end of this procedure, the final decision will be adopted before it is sent to the parties and published, without prejudice to the consequences of the possible application of the consistency mechanism provided for by the GDPR.