3 ms·

From the article: > IAB Europe argued that it is not responsible under the GDPR as a “data controller” because it allegedly only sets the rules for how data sh

From the article: > IAB Europe argued that it is not responsible under the GDPR as a “data controller” because it allegedly only sets the rules for how data should be used, but does not process the data itself. The Court rightly rejected this, and confirmed that IAB Europe, as management body for the TCF, is a “data controller” under the GDPR. IAB stands for Interactive Advertising Bureau Europe [0] [0] https://www.eesc.europa.eu/en/policies/policy-areas/enterprise/database-self-and-co-regulation-initiatives/46 https://www.eesc.europa.eu/en/policies/policy-areas/enterpri...

diggan 3y ago
I must be missing something here, what arguments could IAB Europe reasonable use to say they're not a controller? Article 4 from the GDPR: > ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; Seems so obvious that they're a controller by that definition (specifically a "Joint Controller" according to Article 26), even if "only sets the rules for how data should be used" would be true, that would put them inside the definition, so even by their own admission, they are a controller?
- yxhuvud 3y ago
  If it is essential to their business, people can and will try to convince themselves and other people of just about anything, regardless of how ridiculous the arguments are.
  - toyg 3y ago
    "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!" - Upton Sinclair, 1934.
- secondcoming 3y ago
  The IAB does not actually receive any personal data from anyone. It's pretty much a standards body who write specs for how consent can be granted, and how that consent is transmitted. It's all open, there are no secrets about how this operates. So, it appears that anyone/company who writes a spec around data that may be considered PII is now a Data Controller.
  - deleted 3y ago
    [deleted]
  - troupo 3y ago
    It's not "anyone". It's an association of advertising companies with hundreds of members. They are literally responsible for drafting GDPR-breaking TCF. Why are you surprised they are held responsible?

diggan 3y ago

I must be missing something here, what arguments could IAB Europe reasonable use to say they're not a controller? Article 4 from the GDPR: > ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; Seems so obvious that they're a controller by that definition (specifically a "Joint Controller" according to Article 26), even if "only sets the rules for how data should be used" would be true, that would put them inside the definition, so even by their own admission, they are a controller?

yxhuvud 3y ago
If it is essential to their business, people can and will try to convince themselves and other people of just about anything, regardless of how ridiculous the arguments are.
- toyg 3y ago
  "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!" - Upton Sinclair, 1934.
secondcoming 3y ago
The IAB does not actually receive any personal data from anyone. It's pretty much a standards body who write specs for how consent can be granted, and how that consent is transmitted. It's all open, there are no secrets about how this operates. So, it appears that anyone/company who writes a spec around data that may be considered PII is now a Data Controller.
- deleted 3y ago
  [deleted]
- troupo 3y ago
  It's not "anyone". It's an association of advertising companies with hundreds of members. They are literally responsible for drafting GDPR-breaking TCF. Why are you surprised they are held responsible?