This browser is not actively supported anymore. For the best passle experience, we strongly recommend you upgrade your browser.
| 1 minute read

Belgian DPA approves TCF action plan

The Belgian DPA announced yesterday that it has approved IAB Europe's action plan for bringing IAB's Transparency and Consent Framework (TCF) into compliance with the GDPR. The Belgian DPA says that IAB Europe now has six months to implement the proposed measures.

Producing the action plan was a requirement imposed by the Belgian DPA in its February 2022 decision, which found that the TCF was non-compliant with the GDPR in a number of respects. However, that enforcement decision was put on hold pending IAB Europe's appeal to the Belgian Market Court. On 7th September 2022, the Belgian Market Court referred several questions to the CJEU, seemingly kicking the matter into the long grass (for several months at least). 

Given the foundational questions which will form part of the CJEU hearing to come (in particular the question of whether IAB Europe is a controller for processing undertaken through the TCF), it is uncertain whether or not the Belgian DPA could actually force IAB Europe to implement the action plan within the required six month period. When the Belgian DPA announced in October 2022 that it would go ahead with its review of the action plan, IAB Europe put out a statement saying that "while the action plan is a basis for discussion to continue the work on improving the TCF, IAB Europe firmly believes that the APD decision cannot be enforced." This rather suggests that IAB Europe and the Belgian DPA have different views on the legal status of the action plan.

The announcement is nonetheless a positive development for TCF participants. Back in February 2022, there was significant concern that the Belgian DPA's findings could leave the adtech ecosystem without a viable means of obtaining and disseminating user consents. It does now appear that a revised solution which meets regulatory approval is a real possibility. 

Update 11/01/2023 : The Litigation Chamber of the Belgian DPA approves IAB Europe's action plan The Litigation Chamber of the Belgian DPA has informed IAB Europe today that it approves its action plan aimed at bringing the processing of personal data in the context of TCF into compliance with the provisions of the General Data Protection Regulation (GDPR). In a decision of 2 February 2022, the Litigation Chamber had found a series of breaches of the GDPR by IAB Europe and ordered the company to submit an action plan for the implementation of corrective measures. After having postponed the validation of the action plan pending the appeal before the Market Court, which decided to refer preliminary questions to the CJEU without annulling the decision of 2 February 2022, the Litigation Chamber has now formally validated the action plan.