Belgian data protection authorities are poised to make a decision that could have far-reaching implications for Europe’s multi-billion euro online advertising market.
IAB Europe, an international digital marketing and advertising association, is the subject of complaints about its approach to sharing data about people’s privacy preferences in order to bid in real time for website advertising.
The Belgian data protection authority (DPA) is considering the ruling and it is expected that it will lead to a draft ruling that will be reviewed by data protection authorities across Europe.
The ruling could have an impact on the Transparency and Consent Framework (TCF), a “consent solution” designed to help online advertisers comply with the EU General Data Protection Directive and the EU Electronic Privacy Directive. when they process personal data or access or store information on a user’s device. such as cookies, advertising identifiers, device identifiers, and other tracking technologies.
On a declaration, the IAB said the APD was established to identify breaches of the GDPR in a draft resolution. “It will also find that those infractions should be able to be remedied within six months of the issuance of the final judgment, in a process that would involve APD overseeing the execution of an action plan agreed by IAB Europe,” he said.
According to the IAB, the draft resolution says it should be a legal data controller for “digital signals created on websites to capture data subjects’ choices about the processing of their personal data for digital advertising, content and measurement.” according to TCF. “It is understood that the APD considers these signals to be personal data,” he said.
IAB Europe is also expected to be a joint controller of TC Strings in the specific context of OpenRTB, software commonly used in the online advertising industry to manage real-time bids for web advertising.
“Based on the guidance of other DPAs so far and the fact that IAB Europe does not process, own or decide in any way the use of specific TC strings, as well as relevant jurisprudence and its own interpretation of the GDPR, IAB Europe has not been considered a data controller in the context of the TCF.
“Therefore, it has naturally failed to fulfill certain obligations that fall to data controllers under the Regulation. The draft resolution will require IAB Europe to work with APD to ensure that these obligations are fulfilled in the future,” said the release.
The global market for real-time bidding could be worth as much as $ 27.2 billion by 2024, growing by around 30 percent each year. according to some estimates.
TO report by the Irish Council for Civil Liberties said that Google’s RTB system sends this data to 968 companies. He said that a data brokerage firm that uses RTB data to profile people influenced the 2019 Polish parliamentary elections by targeting LGBTQ + people.
The report said that Google’s RTB system had been used to target 1,200 people in Ireland identified for substance abuse, diabetes and other health conditions.
IAB Europe said it was optimistic that it could form an action plan under the supervision of the APD that should allow approval of the TCF as a transnational GDPR Code of Conduct (CoC) by the APD and the European Data Protection Board. in plenary session (EDPB).
But that could be just one outcome of the case, said Neil Brown, director of the English virtual law firm decoded.legal, a technology expert.
“It’s probably somewhere on the spectrum of the IAB that needs to make a change to its framework and all the consent tools that are based on it change slightly; through a little more transparency; through more significant or general changes in the way this kind of tracking is done and surveillance, down to what I suspect some of the whistleblowers want, which is the end of this kind of online tracking, “he said. ®