The Austrian privacy campaign group None of Your Business asked the country’s data regulator to investigate the firms for violating GDPR, the data regulation that came into force last May.
The group said the companies failed to provide basic information, such as how they buy and sell user data, when contacted by 10 private citizens with requests for their personal information.
“When tested, none of these systems provided the user with all relevant data.
In most cases, users only got the raw data, but, for example, no information about who this data were shared with.
This leads to structural violations of users’ rights, as these systems are built to withhold the relevant information,” said Max Schrems, co-founder and director of NOYB, who has already beaten Facebook in a major privacy case and filed complaints against the company across Europe.
GDPR grants users the right to be informed about where and how their data are transacted, and how long it is stored for.
This “right to access” is enshrined in Article 15, with violations theoretically leading to fines of up to €20m or 4 per cent of the companies’ worldwide turnover.
