APD Belgium: IAB, Finance & NIS2
Belgium's data watchdog holds a unique spot in the EU. The country hosts EU and NATO head offices. It has more global banks and financial bodies than any EU state except Luxembourg. That gives the Autorité de protection des données/Gegevensbeschermingsautoriteit (APD/GBA) wide reach and clout.
The IAB Europe Ruling
In February 2022, Belgium's regulator ruled against IAB Europe. The case was about the Transparency and Consent Framework (TCF). The TCF drives about €220 billion in EU digital ads each year.
What the watchdog found: The TCF consent string is personal data. It ties to a user's pseudonymous ID. IAB Europe was named a joint controller. This made it liable for how publishers and ad firms use that data.
The €250,000 fine was small. The real impact was far bigger. The authority required a full TCF redesign. Every EU publisher using a consent tool felt this. So did every ad buyer.
The lesson: whole-sector tech can breach GDPR. It is not just lone firms at risk. The whole chain can be held to account. No link in that chain is safe from scrutiny.
Financial Sector: NIS2 and GDPR Together
Belgium is home to the EU Banking Authority, EIOPA, and the SWIFT global hub. Banks and insurers there must meet both GDPR Article 32 and NIS2 Article 21. These two laws share much ground.
NIS2 Article 21 sets out these rules:
- Risk checks in human, physical, and digital areas
- Incident reports filed within 24 hours
- Business recovery plans
- Supply chain security checks
- Encryption for data in motion and at rest
- Multi-factor access controls
GDPR Article 32 sets out these rules:
- Data masking and encryption of personal records
- Ability to restore access after an incident
- Regular testing of security controls
- Risk-based technical safeguards
These controls appear in both laws: encryption, access control, incident response, and supply chain checks. Strong GDPR Article 32 programs meet most NIS2 Article 21 needs too. One set of joined-up controls is the most efficient path. See our GDPR compliance guide for a full review of both laws.
Enforcement in 2024: Key Themes
Belgium's regulator issued 82 decisions in 2024. Financial sector cases rose 56% from 2023. Four themes stand out.
Profiling without consent: Banks using transaction data for spending analysis or product offers must meet GDPR rules. The watchdog rejected "service improvement" as a valid reason when profiling relies on such data.
AI credit scoring: GDPR Article 22 governs automated credit decisions. It demands human review and clear reasons. Several fintech firms lacked these safeguards. This was a key focus.
Post-merger data merges: Banks that merged records after buyouts often broke purpose rules. The original consent did not cover the new combined use.
Outsourcing without transfer tools: Firms that sent IT work to third countries without proper legal tools faced action. Cases covered India, Morocco, and the Philippines.
For firms with Belgian banking ops: joined-up GDPR and NIS2 controls are the best defense before an audit. Our security and compliance overview covers how zero-knowledge design cuts exposure at the source.
Sources
- APD/GBA: Belgian Data Protection Authority — VERIFIED-EXTERNAL
- APD: IAB Europe TCF Decision, February 2022 — VERIFIED-EXTERNAL
- EBA: NIS2 Implementation Guidance — VERIFIED-EXTERNAL