The online advertising personalisation identifier constitutes personal data

The CJEU ruling confirms the correct practice of the supervisory authority in considering identifiers as personal data.

Following the judgment of the Court of Justice of the European Union (CJEU) of March 7, 2024 in case C-604/22 IAB Europe, it is not necessary to change national regulations, but this judgment will affect the interpretation of existing regulations in the field of personal data protection - believes Mirosław Wróblewski, the President of the Personal Data Protection Office.

The President of the Personal Data Protection Office presented his observations regarding this judgment in a letter to Adam Szłapek, Minister for the European Union. He emphasises that the CJEU ruling confirms the practice of the Personal Data Protection Office related to the approach to understanding and applying the definition of personal data contained in Article 4(1) of the GDPR.

The CJEU in case C-604/22 IAB Europe stated that a string consisting of a combination of letters and characters, such as TC String (Transparency and Consent String), containing information about the preferences of an Internet or application user relating to that user's consent to the processing of his/her personal data by, among others, website providers, constitutes personal data within the meaning of Article 4(1) of the GDPR when such a person can be identified in combination with additional data, such as the IP address of the user's device or other identifiers.

In a letter to the Minister for European Union, the President of the Personal Data Protection Office draws attention to the fact that the current case law of the Court of Justice of the European Union shows that the concept of personal data should be understood broadly. They are information in the form of opinions, assessments - including subjective ones - and the condition for them to be considered personal data as defined in the GDPR is that the information concerns a person.

"Also in the Polish doctrine of data protection law, it is emphasised that any information, regardless of the manner and form of its expression, may be subject to assessment from the point of view of the definition of personal data," emphasises Mirosław Wroblewski. "In its jurisprudential practice, the supervisory authority consistently assumes that information which, using additional data, can be attributed to a natural person constitutes this person’s personal data."

The Court also ruled that IAB Europe, as an entity that has established a set of rules for its members regarding consent to data processing in certain situations, will be a joint controller of the data processed by its members. Admittedly, this joint controllership is limited to operations in which the IAB establishes the purposes and means of that processing.

The President of the DPA also stressed that the ruling in this regard also corresponds to the assessment adopted by the data protection supervisory authority in its cases in the context of the definitions of controller and joint controller.

The letter to the Minister of European Union, analysing the CJEU ruling in case C-604/22 is attached below (in Polish).