APD Belgium: IAB, Finance & NIS2
Belgium's data watchdog holds a unique spot in the EU. The country hosts EU and NATO head offices. It has more global banks and financial bodies than any EU state except Luxembourg. That gives the Autorité de protection des données/Gegevensbeschermingsautoriteit (APD/GBA) wide reach and clout.
The IAB Europe Ruling
In February 2022, Belgium's regulator ruled against IAB Europe. The case was about the Transparency and Consent Framework (TCF). The TCF drives about €220 billion in EU digital ads each year.
What the watchdog found: The TCF consent string is personal data. It ties to a user's pseudonymous ID. IAB Europe was named a joint controller. This made it liable for how publishers and ad firms use that data.
The €250,000 fine was small. The real impact was far bigger. The authority required a full TCF redesign. Every EU publisher using a consent tool felt this. So did every ad buyer.
The lesson: whole-sector tech can breach GDPR. It is not just lone firms at risk. The whole chain can be held to account. No link in that chain is safe from scrutiny.
Financial Sector: NIS2 and GDPR Together
Belgium is home to the EU Banking Authority, EIOPA, and the SWIFT global hub. Banks and insurers there must meet both GDPR Article 32 and NIS2 Article 21. These two laws share much ground.
NIS2 Article 21 sets out these rules:
- Risk checks in human, physical, and digital areas
- Incident reports filed within 24 hours
- Business recovery plans
- Supply chain security checks
- Encryption for data in motion and at rest
- Multi-factor access controls
GDPR Article 32 sets out these rules:
- Data masking and encryption of personal records
- Ability to restore access after an incident
- Regular testing of security controls
- Risk-based technical safeguards
These controls appear in both laws: encryption, access control, incident response, and supply chain checks. Strong GDPR Article 32 programs meet most NIS2 Article 21 needs too. One set of joined-up controls is the most efficient path. See our GDPR compliance guide for a full review of both laws.
Enforcement in 2024: Key Themes
Belgium's regulator issued 82 decisions in 2024. Financial sector cases rose 56% from 2023. Four themes stand out.
Profiling without consent: Banks using transaction data for spending analysis or product offers must meet GDPR rules. The watchdog rejected "service improvement" as a valid reason when profiling relies on such data.
AI credit scoring: GDPR Article 22 governs automated credit decisions. It demands human review and clear reasons. Several fintech firms lacked these safeguards. This was a key focus.
Post-merger data merges: Banks that merged records after buyouts often broke purpose rules. The original consent did not cover the new combined use.
Outsourcing without transfer tools: Firms that sent IT work to third countries without proper legal tools faced action. Cases covered India, Morocco, and the Philippines.
For firms with Belgian banking ops: joined-up GDPR and NIS2 controls are the best defense before an audit. Our security and compliance overview covers how zero-knowledge design cuts exposure at the source.
When This Approach Has Limits
Treating GDPR Article 32 and NIS2 Article 21 as one joined-up control set is the efficient path for Belgian banks and insurers — but limits remain worth stating plainly.
A consent string can be personal data even when it looks anonymous. The IAB Europe ruling found the TCF consent string was personal data because it tied to a pseudonymous identifier, which is the same trap masking faces: removing names and account numbers does not anonymize a record if quasi-identifiers or a linked token still point back to a person. In banking, transaction patterns, branch, and balance ranges can re-identify a customer after direct identifiers are gone. Data in that state is pseudonymized, not anonymized, and stays in full GDPR scope, so decide deliberately which standard each shared dataset actually meets.
Detection accuracy bounds masking, and bilingual text complicates it. GDPR Article 32 calls for masking and encryption of personal records, but masking only protects fields the system recognized. Belgian documents arrive in both French and Dutch, often mixed within one institution, and NER accuracy varies by language. A pipeline tuned for one language will miss names, addresses, and free-text details in the other, leaving a residual false-negative rate. Configure and test detection separately for French and Dutch against held-out documents rather than assuming a single model covers both.
Shared controls support an audit but do not constitute compliance. The APD assesses the organization's whole posture, and several 2024 themes sit outside any masking tool: lawful basis for profiling, Article 22 human review of AI credit scoring, purpose limits after post-merger data merges, and Article 46 transfer tools for work sent to India, Morocco, or the Philippines. Encryption and detection help meet NIS2 and Article 32 technical requirements, but they cannot supply a balance test, a human-review process, or a transfer mechanism. Legal and human review of these arrangements remains required.
Sources
- APD/GBA: Belgian Data Protection Authority — VERIFIED-EXTERNAL
- APD: IAB Europe TCF Decision, February 2022 — VERIFIED-EXTERNAL
- EBA: NIS2 Implementation Guidance — VERIFIED-EXTERNAL