Is IAB Europe a joint controller? Unpacking the CJEU answer to question two

Summary + thoughts on the CJEU’s answer to the 2nd question (“is IAB Europe (joint) controller?”) in the�IAB Europe�& TCF case (C-604/22). [Again, I may be biased]

– 55: Broad definition of “controller” in order to ensure an effective and complete protection of data subjects (C-210/16)

57: A natural or legal person who influence “for purposes that are its own” the processing of personal data and thus takes part in the determination of the purposes & means of that processing can be “joint controller” (C-25/17 + C-683/21)

59: If 2 parties have “converging” decisions (rather than common decisions) re purposes and means, those decisions must complete each other with a “specific effect” on the determination of those purposes and means (C-683/21).

61 & following: Perhaps incorrect assumption? IAB Europe “influences, for purposes that are its own, the processing of personal data, such as the TC String
63, for instance, says that the TCF aims to “encourage and enable the sale and purchase of advertising space on the Internet” by online ad bidding participants – despite our explanations about the actual aim of the TCF.

65 is odd too: re determination of the means the CJEU suggests that a compliance programme is a “means” of processing (??).

65 + 67 + 68 are odd, as they suggest that technical standards are necessarily determinations of the “means” of processing. This may lead to some debate before the Market Court.

And obviously, “IAB Europe” is the decider for everything – irrespective of how the TCF specs and policies are actually made (we had provided documentation on this).

Positive note: 70: “possible” joint controllership of the sector organisation does *not* extend “automatically” to further processing. Strange that the CJEU only refers to purposes of online targeted advertising and not the many other purposes – perhaps again due to a flawed understanding of the facts?

Lots to discuss before the Market Court!

[re Q1 (“Is the TC String personal data?”), see my other post: https://lnkd.in/eBnntQ-q ]

data protection privacy gdpr