Last week, Privacy International accused seven firms of violating the provisions of the GDPR. Among the accused organizations are Oracle and Equifax. Privacy International filed a complaint against two data brokers, three ad-tech firms and two credit referencing agencies with French authorities, the Irish Data Protection Commission (DPC) and the Information Commissioner's Office (ICO). The accusations include the firms’ disregard for several data protection principles, including purpose limitation, data minimisation, and data accuracy.
The accusation is not coming out of nowhere. Privacy International are basing their allegations on more than 50 data subject access requests that were made towards these companies, as well as information they have provided in the marketing materials and their privacy policies.
Privacy International's legal officer Ailidh Callander declared: "The data broker and ad-tech industries are premised on exploiting people's data.” He also added that "GDPR sets clear limits on the abuse of personal data. PI's complaints set out why we consider these companies' practices are failing to meet the standard - yet we've only been able to scratch the surface with regard to their data exploitation practices."
Other than the giants Oracle and Equifax, the accused companies include Acxiom, Criteo, Experian, Quantcast and Tapad. Privacy International claims that none of these companies has legal basis for the way in which they use personal data. Upon learning of the accusations, a Criteo spokesperson declared "Whilst disappointed that they have chosen to take this action, we have complete confidence in our privacy practices and we remain open to answer any questions that PI may have". Equifax, Oracle, and Quantcast refused to comment.
Finally, an ICO representative said "These concerns have been raised with regulators in different EU countries and the ICO will be working with the relevant data protection authorities, and the new European Data Protection Board, to consider the facts and support any possible joint work or inquiries in other jurisdictions."