The EU’s highest court has found that a group representing companies involved in digital advertising and marketing can be regarded as a data controller under the GDPR data-privacy rules.

The case centres on the real-time auction system in which advertisers compete to display adverts tailored to each online user’s personal profile.

It involves IAB Europe, a non-profit association established in Belgium that represents undertakings in the digital advertising and marketing sector at European level.

The association had developed a ‘transparency-and-consent string’ (TC String) that encodes and stores users’ preferences, and had presented it as bringing the auction system into line with the GDPR.

Belgium’s data-protection authority, however, found that IAB had been acting as a data controller without fully complying with the GDPR – a decision that IAB is contesting in the Brussels Court of Appeal.

Identifiable user

Answering questions from the Brussels court, the Court of Justice of the European Union (CJEU) found that the TC String contained information about an identifiable user and, therefore, constituted ‘personal data’ within the meaning of the GDPR.

“Where the information contained in a TC String is associated with an identifier, such as, inter alia, the IP address of the user’s device, that information may make it possible to create a profile of that user and to identify him or her,” the judges stated.

They added that IAB Europe must also be regarded as a ‘joint controller’ within the meaning of the GDPR, as it appeared to “exert influence over data-processing operations when the consent preferences of users are recorded in a TC String, and to determine, jointly with its members, both the purposes of those operations and the means behind them”.

‘Highly sensitive data’

The court added, however, that IAB could not be regarded as a data controller in relation to operations occurring after the consent preferences of users were recorded in a TC String.

The Irish Council of Civil Liberties (ICCL) has welcomed the ruling, saying that it showed just how broad the protection of people’s personal data was in Europe.

“The online tracking and advertising industry is surreptitiously collecting and broadcasting highly sensitive data about everyone who uses the internet. Today’s decision will force the industry to change profoundly,” it stated.