PROFILE
Mandate and constitution
The Belgian Autorité de Protection des Données / Gegevensbeschermingsautoriteit (APD/GBA) was established in its current form by the Loi du 3 décembre 2017 portant création de l'Autorité de protection des données, replacing the earlier Commission de la Protection de la Vie Privée. The current structure took effect alongside the GDPR application date of 25 May 2018. The APD is designated as the Belgian supervisory authority under Article 51 GDPR for the territory of Belgium and as lead authority under Article 56 for any controller with its main EU establishment in Belgium.
The APD has a notably structured internal architecture, with five distinct services: Frontline (complaint reception and informal resolution), Investigation (formal inquiries), Litigation (sanctioning chamber), Knowledge (guidance and opinions) and Executive Secretariat. Each service is led by a Director. The structure separates investigation from sanctioning to ensure procedural independence, mirroring the institutional separation in the French CNIL and satisfying ECHR Article 6 requirements on procedural fairness.
The IAB Europe TCF case in detail
The Interactive Advertising Bureau Europe (IAB Europe) Transparency and Consent Framework (TCF) is the technical standard used by the vast majority of European publishers and ad-tech vendors to collect and transmit user consent choices for cookie placement, programmatic-advertising bid request inclusion, and related processing. The framework defines the user-facing consent management platform (CMP) interfaces, a standardised set of purposes (corresponding to processing operations), and a binary encoded string (the TC String) that captures the user's choices and travels with bid requests through the real-time bidding chain.
A coalition of complainants including data-protection NGOs and academic researchers argued that the TCF infringed the GDPR in several material respects: the TC String is personal data, the IAB Europe is a controller for the processing of the TC String, the consent claims encoded in the framework were not validly obtained, the legitimate-interests basis claimed for many processing purposes was not properly assessed, and the security and integrity of the TC String were inadequate. The APD opened an investigation and on 2 February 2022 adopted Decision 21/2022 finding multiple GDPR infringements, imposing a €250,000 fine on IAB Europe and ordering the framework to be brought into compliance within six months.
IAB Europe appealed to the Belgian Market Court (Cour des marchés / Marktenhof). The Market Court referred several preliminary questions to the Court of Justice of the European Union, registered as Case C-604/22 IAB Europe. On 7 March 2024, the Court delivered its judgment. The two key holdings are that the TC String constitutes personal data within the meaning of Article 4(1) GDPR (because it can be linked to an identifiable individual through other available data), and that IAB Europe acts as a joint controller with the framework participants (publishers, ad-tech vendors, advertisers) for the processing of the TC String.
The joint-controllership finding is doctrinally important well beyond IAB Europe. It establishes that a technical standard-setter whose standard involves the processing of personal data can be a joint controller with the standard's participants, even where the standard-setter does not itself process the data. The implications for industry-standard organisations across other sectors (financial messaging, healthcare data exchange, telecoms signalling) are substantial.
Other Belgian decisions
Beyond the TCF case, the APD's enforcement record covers a typical range of national matters. The Proximus (Belgian incumbent telecom) decisions address breach-notification timeliness and customer-data security. Decisions against the Belgian public broadcaster RTBF address marketing consent and newsletter unsubscribe obligations. A 2022 decision against an unnamed political party addressed the unlawful processing of voter data. Multiple decisions against small businesses address direct-marketing and cookie matters under the Belgian implementation of ePrivacy.
The APD also handles complaints concerning processing by EU institutions (European Commission, Council, Parliament secretariats) where they involve Belgian residents, even though the lead supervisory authority for EU institutions is the European Data Protection Supervisor (EDPS) rather than the national DPA. The Brussels-headquartered EU institutional cluster gives the APD an unusual quotient of cross-institutional engagement.
Recent enforcement trends
The APD's 2024-2026 enforcement priorities include continued IAB Europe TCF compliance verification (post-CJEU), AI-system processing (including generative AI), connected vehicles, the Belgian application of the EU AI Act intersect with GDPR, and the perennial cookie/ePrivacy enforcement. The APD has issued joint statements with the EDPB on programmatic-advertising compliance, drawing on the TCF case as the operational reference for industry-wide practice.