Privacy & Information Security Law Blog

On January 11, 2023, the Belgian Data Protection Authority (“Belgian DPA”) announced that it has approved the Interactive Advertising Bureau Europe’s (“IAB Europe”) action plan with respect to its Transparency and Consent Framework (“TCF”).

Background

The Belgian DPA started an investigation into IAB Europe after receiving several complaints since 2019 regarding the TCF. The TCF is a consent solution developed by IAB Europe that has become a widely used approach to collecting and managing consent for targeted advertising cookies in the EU.

On February 2, 2022, the Litigation Chamber of the Belgian DPA imposed a €250,000 fine on IAB Europe for several infringements of the EU General Data Protection Regulation (the “GDPR”), including a lack of appropriate legal basis for the processing of personal data through the TCF, a lack of transparency to users, and infringements to the GDPR principles of accountability, security, and data protection by design and by default. The Belgian DPA also ordered IAB Europe to submit an action plan within two months for the implementation of several corrective measures. The Belgian DPA subsequently postponed the validation of IAB Europe’s action plan, pending the appeal before the Belgian Market Court.

Latest Developments

According to its updated press release, the Belgian DPA has now formally approved IAB Europe’s action plan and IAB Europe has a maximum of six months to implement the proposed measures. The Belgian DPA indicated that it will not further comment on the content of the action plan due to pending court proceedings.