Roqad reposted this
#data #identity #product #operations #dsp #ssp #cdp #customer-success // Team Leader, PM, passionate about ad-tech
Today briefly on the subject of the upcoming European Vendor List update. Some may still be wondering whether the update linked to the release of Special Purpose 3 (Save and Communicate Privacy Choices) applies to them. In particular, in cases where the company's operating model is based on user explicit consent for all purposes, rather than Legitimate Interest (which must be ticked in the case of SP3). Here are some thoughts / tips that came up after my conversation with Ninon Vagner, from the IAB Europe. * The following considerations are related to the recent ECJ ruling that TC String can be considered personal data, - As a vendor, we are free to decide whether to declare Special Purpose 3. However, it is advisable to declare it when we process TC String in combination with other identifiable information such as IP addresses and/or unique identifiers, - Before making any decision, it is required to carry out an LIA at company level (for which the Guide provided by the IAB can be used), - Technically, verifying whether consent has been obtained (or not) actually requires processing a TC string, - Vendors are unlikely to be able to verify that consent has been obtained earlier, and therefore cannot rely on consent to verify consent 😉 - Finally, the fact that the processing of consent is absolutely necessary to respect users' privacy choices, and that such processing does not entail any increased risk to end-users' privacy, justifies that the legal basis of legitimate interest seems appropriate. Not to mention that the reasoning according to which the LI legal basis without the right to object is appropriate for the processing of TC String was confirmed when the APD decided to approve the IAB Action Plan last year. Concluding remarks: - the initial deadline for updating the Vendor Form is tomorrow (3rd of July), but this can be done at any time if the LIA has not yet been completed, - once you have ticked the relevant boxes on the Vendor Form, remember that you also need to declare the retention period (where 0 is meant to indicate that storage is less than a day or non-existent, e.g. maintained during the session or processed on the fly) and add the relevant link to the updated privacy policy (make sure you have TC String declared as LI there), - changes to the vendor list are made weekly on Thursdays (next update will happen on 4th of July), - Vendors are NOT required to resubmit the updated Vendor Compliance form (XLS included with registration). Who among you has already made the update and who is still waiting? I would like to take this opportunity to thank those actively involved in this topic - Ninon Vagner, Peter Craddock, Christoph Zippel, and the rest of the TCF WG at the IAB EU. #gdpr #privacy