Privacy rights group Privacy International has filed complaints with the French authorities, the Irish Data Protection Commission (DPC) and the Information Commissioner’s Office (ICO), against Acxiom, Oracle, Criteo, Quantcast, Tapad, Equifax and Experian over being “premised on exploiting people’s data”.
The complaint accuses the seven firms of disregarding data protection principles, including purpose limitation (specifying how data is used), data minimisation (holding data no longer than is absolutely required) and data accuracy. The organisation is basing its accusations on more than 50 SARs with the companies, as well as information they have provided in their marketing materials and privacy policies.
PI claims that businesses, which buy and sell the data of millions of online consumers, do not have a legal basis to amass such information and have not attained appropriate consents.
The ICO has already issued assessment notices to data broker Acxiom, as well as credit rating agencies Equifax and Experian, but PI urges the data regulator to widen its ongoing investigations to include the other firms.
While most complaints to the regulators have involved the obvious suspects like Google and Facebook, PI says that focus should be shifted towards lesser known big players in the data collection industry.
“The data broker and ad-tech industries are premised on exploiting people’s data. Most people have likely never heard of these companies, and yet they are amassing as much data about us as they can and building intricate profiles about our lives.” said PI lawyer Ailidh Callander.