Regulatory Storm: Nyob’s GDPR Complaint and Microsoft’s Security Breach

Editor’s Note: The tech industry is facing intensified scrutiny as recent events underscore the critical importance of data privacy and cybersecurity. Nyob, a prominent privacy advocacy group, has lodged a formal complaint against Xandr, a Microsoft subsidiary, for severe breaches of the General Data Protection Regulation (GDPR). This complaint reveals significant shortcomings in Xandr’s compliance with data access and erasure requests, posing serious implications for digital advertising and European regulatory standards.

Simultaneously, Microsoft contends with the fallout from a security breach attributed to Russian state-sponsored hackers. This incident, which compromised high-profile U.S. clients, underscores the vulnerabilities even large tech firms face in safeguarding corporate and personal data. Additionally, the Federal Trade Commission (FTC) has taken decisive action against the anonymous messaging app NGL for deceptive practices and violations of children’s data privacy, further highlighting the growing regulatory pressures on tech companies.

These cases collectively signal a shift towards more stringent enforcement of data privacy and security standards. The outcomes will likely set critical benchmarks for compliance and accountability, shaping future industry practices in the digital age.

Industry News – Data Privacy and Protection Beat

Regulatory Storm: Nyob’s GDPR Complaint and Microsoft’s Security Breach

ComplexDiscovery Staff

In an escalating showdown between big tech and data privacy advocates, Nyob, a non-profit organization, has lodged a formal complaint against Xandr, an advertising subsidiary of Microsoft, alleging severe breaches of the General Data Protection Regulation (GDPR). This issue has profound implications for the business sector, particularly those involved in digital advertising and compliance with European regulatory standards.

Nyob’s complaint is rooted in allegations that Xandr, a real-time bidding platform for buying online ad space, failed to comply with data access and erasure requests mandated by the GDPR. According to Nyob, an unidentified Italian individual’s request for personal data access was denied on the grounds that Xandr could not identify him without additional identifiers, an assertion Nyob contests.

Massimiliano Gelmi, a data protection lawyer with Nyob, criticized Xandr’s practices, stating, “Xandr’s business is obviously based on keeping data on millions of Europeans and targeting them. Still, the company admits that it has a 0% response rate to access and erasure requests. It is astonishing that Xandr even publicly illustrates how it breaches the GDPR.” Nyob’s concern is heightened by the sensitivity of the data involved, which includes details on individuals’ health, sexual orientation, political opinions, and financial status.

The stakes are particularly high given that inaccurate information also plagues Xandr’s data. An access request revealed erroneous details such as the complainant being listed under multiple genders, age ranges, and income brackets simultaneously. Gelmi further highlighted this issue, pointing out that inaccurate data allows Xandr to misrepresent users to advertisers, potentially selling the same user profile as being both young and old to different business partners.

Nyob has now escalated their grievance to the Italian Data Protection Authority, Garante, demanding that Xandr align its operations with the principles of data minimization and accuracy. They are also urging for a fine of up to 4% of Xandr’s annual turnover. Microsoft’s stance remains cautiously neutral, with a spokesperson indicating readiness to address any inquiries from the regulatory body.

In a related development, Microsoft faces scrutiny from multiple U.S. clients following a security breach attributed to Russian state-sponsored hackers, known as Midnight Blizzard. The breach, which Microsoft revealed in January, involved the compromise of corporate email accounts through a single set of stolen credentials. The affected clients include the U.S. Department of Veterans Affairs (VA), the U.S. Agency for Global Media, and the Peace Corps.

Midnight Blizzard, also recognized as APT29 and Cozy Bear, is part of Russia’s foreign intelligence service. The VA’s intrusion lasted a mere second, officials reported, but it prompted a comprehensive review and overhaul of security measures across its Microsoft Cloud environments. The VA’s press secretary, Terrence Hayes, noted that an ongoing investigation aims to uncover any further impacts.

The breach also spurred regulatory backlash in the U.S., with federal agencies prompted to secure Microsoft Cloud accounts and reset compromised credentials. Microsoft has committed to ongoing support for impacted customers, but the incident underscores the vulnerabilities even large tech firms face amidst sophisticated cyber-attacks.

Additionally, the Federal Trade Commission (FTC) has broadened its regulatory reach, imposing a $5 million fine on the anonymous messaging app NGL, developed by NGL Labs, for deceptive practices and violations involving children’s data privacy. The FTC and the Los Angeles District Attorney’s Office declared that NGL had misled users into purchasing premium services through fake messages while falsely claiming AI moderation to prevent cyberbullying.

This settlement, pending approval by the U.S. District Court for the Central District of California, not only mandates the fine but also bans NGL from hosting minors on its platform, marking a significant precedent in regulatory action against tech companies. FTC Chair Lina Khan emphasized the need for tighter controls over AI and data privacy, reflecting broader concerns in the industry.

Joao Figueiredo, co-founder of NGL, acknowledged the FTC’s investigation but disputed many of its findings. Figueiredo stated, “We view this resolution as an opportunity to make NGL better than ever for our users and we think the agreement is in our best interest,” signaling a possible shift in the company’s approach to user data and privacy.

These cases collectively highlight the increasing regulatory pressures on tech companies to uphold data privacy and security standards, reflecting a growing commitment from regulatory bodies to mitigate risks and protect consumers. The outcomes of these enforcement actions will likely shape future industry practices and regulatory frameworks, setting critical benchmarks for compliance and accountability in the digital age.

News Sources

• Microsoft-Owned Adtech Firm Accused Of Privacy Breaches And Inaccuracy
• Microsoft Hack Also Impacted VA, Global Media Agency
• FTC Bans Popular Anonymous Messaging App NGL From Serving Minors In First-Of-Its-Kind Move
• FTC says anonymous messaging app failed to stop ‘rampant cyberbullying’
• Popular app banned from hosting young teens in a groundbreaking settlement

Assisted by GAI and LLM Technologies

Additional Reading

• Meta’s AI Expansion Faces Regulatory Roadblocks in Europe and the US
• Combating AI Hallucinations: Oxford Researchers Develop New Detection Method 

Source: ComplexDiscovery OÜ