noyb Files Complaint Against Xander for GDPR Violations in RTB

On 9 July 2024, None Of Your Business (noyb.eu) filed a complaint with the Italian Data Protection Authority (Garante) against Xander Inc., a Microsoft subsidiary, for multiple GDPR violations. The complaint centers around Xander’s alleged non-compliance with GDPR articles related to data minimization, accuracy, transparency, and the rights to access and erasure.

Background and Allegations

noyb’s complaint focuses on Xander’s Real Time Bidding (RTB) platform, which facilitates automated ad space auctions. Investigations in June 2023 revealed that Xander’s RTB platform collected extensive sensitive data on users, including health, sexual orientation, political opinions, and financial status. noyb alleges that Xander mishandled this data and provided inaccurate and conflicting user profiles, which undermines the principles of targeted advertising.

Specific Incidents

The complaint outlines two specific access requests made by a data subject to Emetriq GmbH, a data broker, and directly to Xander in February 2024. Emetriq responded with detailed data, including 200 market segments and 70 profiling events linked to the data subject. In contrast, Xander claimed inability to identify the data subject and did not provide the requested information or erasure.

NOYB’s Requests

noyb’s complaint demands that Garante:

• Ensure Xander complies with access and erasure requests from data subjects.
• Limit data processing to what is necessary and relevant for personalized advertising.
• Correct or erase inaccurate user profiles.
• Provide effective tools for users to exercise their rights.
• Impose a fine on Xander in accordance with GDPR provisions.

The complaint highlights Xander’s failure to comply with GDPR, emphasizing the need for stringent enforcement to protect data subjects’ rights and ensure accurate data processing practices.

The press release is available here.