DATA PROTECTION | The ECJ on auctioning of personal data for advertising purposes

On 7 March 2024, the EU Court of Justice (ECJ) issued its judgment in Case C‑604/22 (IAB Europe v. Gegevensbeschermingsautoriteit, i.e. the Belgian Data Protection Authority), regarding Real Time Bidding (RTB) which is a process that allows companies to bid for advertising space on websites and apps based on users’ profiles. IAB Europe is an association established in Belgium which represents undertakings in the digital advertising and marketing sector and which has drawn up a Transparency & Consent Framework (the “TCF”), a set of rules enabling both the provider and data brokers, or indeed advertising platforms, to process lawfully the personal data of the user of a website or application. The ECJ ruled that a string composed of a combination of letters and characters, such as the “Transparency and Consent String” proposed by the IAB to handle users’ consent, which contains the data subject’s preferences relating to his or her consent to the processing of personal data, itself constitutes personal data. Moreover, the ECJ deemed IAB Europe to be a “joint controller” for data processing purposes. However, it is not considered a controller for subsequent processing operations unless it determines their purposes and means.

Newsletter n. 94 – March 2024