ECJ: Auctioning of personal data for advertising purposes under the GDPR

In a Belgian case, the European Court of Justice clarified the term "personal data" and the conditions under which a sectoral organization, insofar as it provides its members with a framework of rules on consent to the processing of personal data, is to be classified as a "joint controller"’ within the meaning of the General Data Protection Regulation (GDPR). The ECJ also comments on the limits of the joint and several liability of such an organization.

Background

IAB Europe is a non-profit association established in Belgium which represents undertakings in the digital advertising and marketing sector at European level. IAB Europe has drawn up a solution which it presents as being capable of bringing that auction system into conformity with the GDPR. Users’ preferences are encoded and stored in a string composed of a combination of letters and characters referred to as the ‘Transparency and Consent String’ (TC String), which is shared with personal data brokers and advertising platforms so that they know to what the user has consented or objected. A cookie is also placed on the user’s device. When they are combined, the TC String and the cookie can be linked to that user’s IP address.

In 2022, the Belgian Data Protection Authority held that the TC String constitutes personal data within the meaning of the GDPR and that IAB Europe had been acting as data controller without fully complying with the requirements of the GDPR.

Decision

In its judgment, the Court of Justice confirms that the TC String contains information concerning an identifiable user and therefore constitutes personal data within the meaning of the GDPR. Where the information contained in a TC String is associated with an identifier, such as, inter alia, the IP address of the user’s device, that information may make it possible to create a profile of that user and to identify him or her.

Furthermore, IAB Europe must be regarded as a ‘joint controller’ within the meaning of the GDPR. Subject to the verifications which are for the referring court to carry out, that association appears to exert influence over data processing operations when the consent preferences of users are recorded in a TC String, and to determine, jointly with its members, both the purposes of those operations and the means behind them. 

References:

ECJ, PRESS RELEASE No 44/24 of 7 March 2024.

The ECJ judgment of 7 March 2024, C‑604/22 IAB Europe to be found here.