IAB Europe fined €250,000 after Transparency and Consent Framework ruled unlawful
IAB Europe has been fined €250,000 (£208,300) by the Belgian Data Protection Authority after its Transparency and Consent Framework, which is the mechanism used by 80 per cent of the European internet to seek consent for tracking personal data for online advertising targeting, was ruled non-compliant with the GDPR. The decision was taken by 28 EU data protection authorities, led by the Belgian Data Protection Authority, as the leading supervisory authority in the GDPR’s one-stop-mechanism. The decision is immediately binding and enforceable across the European Union.
The regulators found that IAB Europe commits multiple violations of the GDPR in its processing of personal data in the context of the TCF and the real-time bidding system OpenRTB. The ruling said it fails to ensure personal data are kept secure and confidential. It fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible because of the severe risk posed by online advertising tracking. And that it fails to provide transparency about what will happen to people’s data.
It also found that IAB Europe had failed to honour its data protection obligations to maintain records of data processing; to conduct a data protection impact assessment; and to appoint a Data Protection Officer. The Belgian Data Protection Authority described IAB Europe as “negligent”.
In addition to the fine, IAB Europe has been ordered to delete all TC (Transparency Consent) Strings and other personal data already processed in the TCF from all its IT systems. In its
report on the verdict, the Irish Council for Civil Liberties stated that this decision would also apply to the more than 1,000 companies that pay IAB Europe to use the TCF, including Google’s, Amazon’s and Microsoft’s online advertising businesses.
The regulators have given IAB Europe two months to submit an action plan to achieve compliance to the Belgian Data Protection Authority, and six months to implement it.