Belgian DPA approves TCF action plan

The Belgian DPA announced yesterday that it has approved IAB Europe's action plan for bringing IAB's Transparency and Consent Framework (TCF) into compliance with the GDPR. The Belgian DPA says that IAB Europe now has six months to implement the proposed measures.

Producing the action plan was a requirement imposed by the Belgian DPA in its February 2022 decision, which found that the TCF was non-compliant with the GDPR in a number of respects. However, that enforcement decision was put on hold pending IAB Europe's appeal to the Belgian Market Court. On 7th September 2022, the Belgian Market Court referred several questions to the CJEU, seemingly kicking the matter into the long grass (for several months at least). 

Given the foundational questions which will form part of the CJEU hearing to come (in particular the question of whether IAB Europe is a controller for processing undertaken through the TCF), it is uncertain whether or not the Belgian DPA could actually force IAB Europe to implement the action plan within the required six month period. When the Belgian DPA announced in October 2022 that it would go ahead with its review of the action plan, IAB Europe put out a statement saying that "while the action plan is a basis for discussion to continue the work on improving the TCF, IAB Europe firmly believes that the APD decision cannot be enforced." This rather suggests that IAB Europe and the Belgian DPA have different views on the legal status of the action plan.

The announcement is nonetheless a positive development for TCF participants. Back in February 2022, there was significant concern that the Belgian DPA's findings could leave the adtech ecosystem without a viable means of obtaining and disseminating user consents. It does now appear that a revised solution which meets regulatory approval is a real possibility.