24/07/2024
Faros associate Sofie Deprez wrote an annotation on the ECJ judgment of 7 March 2024, 'IAB Europe'. This judgment concerns the scope of the concept of 'personal data' within the meaning of Article 4(1) GDPR, as well as on the qualification of joint controllers.
In its decision, the ECJ held that the TC string in IAB Europe's Transparency and Consent Framework (TCF) could potentially be considered personal data. In doing so, the ECJ essentially emphasised the element of 'identifiability' in the definition of 'personal data' under the GDPR. While the broad scope given by the ECJ to the concept of personal data should not be surprising, it is important, in our view, to always take all elements of the definition of 'personal data' into account when making an assessment. Such an approach clarifies the ECJ's characterisation of the TC string as personal data. Curious about the whole article? It can be found in Tijdschrift Computerrecht 2024/97 and on our website on the 'Publications' page, under 'Articles'.