Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Italy: NOYB files complaint with Garante for alleged GDPR violations by Xander

On July 9, 2024, None Of Your Business (NOYB) announced that it filed a complaint with the Italian data protection authority (Garante) regarding alleged violations of the General Data Protection Regulation (GDPR) by Xander Inc. The complaint specifically alleges violations of Articles 5(1)(c), 5(1)(d), 12(2), 15, and 17 of the GDPR for alleged failures to adhere to principles related to transparency, right of access, and the use of inaccurate information about users.

What’s the cause of the complaint?

NOYB’s complaint states that Xander manages a Real Time Bidding (RTB) platform that enables advertisers to buy space from online publishers in real-time by using algorithms when a user visits a platform. NOYB stated that in June 2023, investigative journalists determined that Xander collected categories of sensitive profiles concerning data subjects in Europe which contained personal information, including:

  • health data;
  • data regarding sex life and sexual orientation;
  • political or philosophical opinions;
  • religious beliefs; and
  • financial status.

The complaint alleges that on February 19, 2024, a data subject made an access request with emetriq GmbH, a data broker that provides information to Xander. The complaint also alleges the same data subject also made a request directly to Xander on February 27, 2024. According to the complaint, both access requests concerned the placement of cookies on the data subject’s equipment. In response, the complaint alleges that Xander was unable to identify, provide access to, or erase data due to being unable to identify the data subject whereas emetriq provided a copy of over 200 market segments linked to the data subject and 70 profiling events. The complaint also states that emetriq confirmed that Xander is among a list of recipients of the data subject's information.

Requests of the complaint

As the data subject is Italian and resides and works in Italy, NOYB's complaint requests that the Garante order Xander to:

  • comply with the data subjects' access and erasure requests;
  • limit the processing of personal data to what is adequate, relevant, and necessary for personalized advertising;
  • erase or rectify all inaccurate profiles or market segments used for targeted advertising;
  • provide an effective tool for users to exercise their rights to erasure and access; and
  • impose a fine according to GDPR.

You can read the press release here and the complaint here.