European privacy advocacy group, noyb, has filed a complaint against Microsoft-owned adtech company Xandr, alleging transparency failings and breaches of data access rights. The complaint, lodged with Italy’s data protection authority under the General Data Protection Regulation (GDPR), could result in fines of up to 4% of Microsoft’s global annual turnover if successful. The complaint accuses Xandr of using inaccurate information and failing to respond to data access and deletion requests. Xandr claims it cannot comply with GDPR data access rights due to the pseudonymous nature of the data it collects, but noyb argues that as an adtech company that relies on profiling individuals for targeted advertising, Xandr should be able to identify the people whose data it holds. Noyb also found high levels of inaccuracy in the data Xandr holds, raising concerns about the quality of its ad targeting services. The GDPR grants individuals the right to rectification of incorrect data and the ability to request a copy of their data, both of which noyb alleges Xandr is not compliant with. The complaint also highlights previous research showing that Xandr collects sensitive information without explicit consent. This complaint could lead to further regulatory risk for Xandr in other EU Member States where it has processed locals’ data.
