Verdict of EU CJ, IAB Europe is een joint-controller voor de AVG. En daarmee ook aan te pakken. Ook de volgende iteratie van IABEurope om onder de AVG uit te komen faalt dus.

1 TC String is personal data under the GDPR: "a string composed of a combination of letters and characters, such as the TC String, containing the preferences of a user of the internet or of an application relating to that user’s consent to the processing of personal data concerning him or her by website or application providers as well as by brokers of such data and by advertising platforms constitutes personal data within the meaning of that provision in so far as, where those data may, by reasonable means, be associated with an identifier, such as, inter alia, the IP address of that user’s device, they allow the data subject to be identified. In such circumstances, the fact that, without an external contribution, a sectoral organisation holding that string can neither access the data that are processed by its members under the rules which that organisation has established nor combine that string with other factors does not preclude that string from constituting personal data within the meaning of that provision."

2 IABEurope is a joint controller: "first, a sectoral organisation, in so far as it proposes to its members a framework of rules that it has established relating to consent to the processing of personal data, which contains not only binding technical rules but also rules setting out in detail the arrangements for storing and disseminating personal data relating to such consent, must be classified as a ‘joint controller’ for the purpose of those provisions where, in the light of the particular circumstances of the individual case, it exerts influence over the personal data processing at issue, for its own purposes, and determines, as a result, jointly with its members, the purposes and means of such processing. The fact that such a sectoral organisation does not itself have direct access to the personal data processed by its members under those rules does not preclude it from holding the status of joint controller for the purpose of those provisions";

https://web.archive.org/web/20240325144725/https://www.golem.de/news/tracking-und-cookies-dieses-urteil-koennte-die-online-werbung-veraendern-2403-183186.html

Oordeel over IAB latest trick mbt real time bidding. IAB is again determined to be a processor. I think this is their 3rd of even 4th iteration. High time a judge concludes they aren't good faith actors (and never were). The Transparency and Consent string is judged to be personal information as it contains both a url and personal user preferences. IAB and not only their individual members can now centrally be prosecuted for GDPR violation.