Privacy advocacy group Nyob has lodged a complaint against Microsoft’s advertising subsidiary Xandr, alleging violations of data access rules and inaccurate data practices. Xandr, acquired by Microsoft in 2021, is a real-time bidding platform that allows advertisers to purchase ad space based on user interests and characteristics. The complaint alleges that Xandr denied an individual’s request for access to personal data under GDPR, claiming inability to identify the individual. Nyob argues that this case is not isolated, as Xandr reported a zero response rate to access and erasure requests in 2022.
Data protection lawyer Massimiliano Gelmi of Nyob criticizes Xandr’s zero response rate to access and erasure requests, highlighting the company’s reliance on storing data on millions of Europeans for targeted advertising. The sensitivity of the personal data involved, including health, sex life, political beliefs, and financial status, raises concerns. Nyob’s investigation reveals inaccuracies in the data stored by Xandr, with conflicting information about the complainant’s gender, age, income, and employment status. Gelmi emphasizes the importance of accurate data for advertisers and criticizes the chaotic mix of conflicting information in Xandr’s dataset.
Nyob has escalated the issue by filing a GDPR complaint with the Italian data protection authority Garante, addressing transparency issues, the right of access, and the use of inaccurate user information by Xandr. Nyob is urging Garante to enforce data minimization and accuracy principles on Xandr and impose fines of up to 4% of Xandr’s annual turnover. Microsoft, the parent company of Xandr, has responded briefly, stating their readiness to cooperate with regulatory authorities. The complaint against Xandr sheds light on the challenges posed by big tech companies in handling user data and the importance of enforcing data protection regulations to safeguard user privacy.
The complaint against Xandr reveals broader concerns about the advertising industry’s practices and the lack of accountability in handling personal data. Nyob’s advocacy work highlights the need for stricter regulations and enforcement mechanisms to ensure compliance with data protection laws. The case also underscores the importance of transparency and accuracy in data processing operations to prevent misuse and protect user privacy. By holding companies like Xandr accountable for their data practices, Nyob aims to create a safer and more secure online environment for users.
The implications of the complaint against Xandr extend beyond individual privacy concerns to the broader implications for data protection and consumer rights. By challenging the data practices of a major tech company like Xandr, Nyob is calling attention to the need for greater accountability and transparency in the digital advertising industry. The outcome of this case could set a precedent for how big tech companies handle user data and could lead to stronger data protection measures in the future. As the regulatory authorities investigate the complaint, the spotlight remains on the importance of protecting user data and upholding privacy rights in the digital age.
