“Xandr, an adtech business owned by Microsoft, is facing a complaint from European privacy advocacy group noyb. The complaint, filed in Italy under the European Union’s General Data Protection Regulation (GDPR), accuses Xandr of transparency failings and breaches of data access rights. The company is alleged to be using inaccurate information about individuals and failing to respond to data access and deletion requests. If the complaint is successful, Xandr could face fines of up to 4% of Microsoft’s annual global turnover.
The complaint argues that Xandr cannot claim to be unable to identify individuals whose information it holds, as its entire business model relies on profiling individuals for targeted advertising. Furthermore, the GDPR defines pseudonymized data as personal data, meaning Xandr is still obligated to comply with data access rights. The European Data Protection Board has provided guidelines stating that adtech companies should be able to identify individuals making data access requests, notably through cookies.
In addition to the issue of data access, noyb’s research suggests that Xandr holds inaccurate information on individuals, raising questions about the quality of its ad targeting services. The GDPR grants individuals the right to rectification of incorrect data held about them. Furthermore, the complaint alleges that Xandr is not compliant with individuals’ right to obtain a copy of their data.
Noyb discovered the inaccuracies in Xandr’s data by using a subject access request to one of its data broker suppliers, emetriq. The information obtained showed contradictory personal data about individuals, making accurate ad targeting difficult. This suggests that some parts of the advertising industry prioritize profit over accurate information. It remains unclear how Xandr obtained the necessary consents for processing sensitive data, such as information about individuals’ sex life or sexual orientation, religion beliefs, and political opinions.
The outcome of this complaint could have significant implications for Xandr and highlight the importance of compliance with data protection regulations. As a subsidiary of Microsoft, its actions also reflect on the parent company. It remains to be seen how Microsoft will respond to the complaint and whether it will take steps to address the alleged transparency failings and breaches of data access rights. Regardless, this case serves as a reminder to businesses operating in the adtech industry to prioritize data protection and transparency to avoid potential legal repercussions.”
Source link
