Belgian DPA decision emphasizes on a lack of an appropriate legal basis for processing and transfer to ad tech partners, insufficient information to users, general non-compliance with regard to data protection by design and accountability.
Concretely this means:
– Ban on use of legitimate interest
– Obligation to assess parties that connect to the ad network for compliance with GDPR
– Fine of 250,000.-
– Obligation to come up with action plan within 2 months to tackle the issues.