6

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling.

Following this, I make the assumption that this qualifies as personal data under GDPR since my name and first name uniquely identify me as far as it can be tested.

When I request my personal data from google, I got about 2gb. Mostly my emails and, in the end, nothing really valuable.

I'm using iOS for all mobile activity and I don't have chrome, so it probably limited data capture.

The surprise was that they had a list of flights I made and I'm not sure how this was captured.

But my question is about the index: I can be found under the index and my name, the "personal data", has to be part of their database index.

So, under GDPR, I should get a copy of the index entries when my name appears, shouldn't I?

Also, if this constitute "personal data", shouldn't I have the ability to request either:

  • deletion, under the right to be forgotten
  • or, stop processing, where they can keep data but not use it?

It looks like Google is considering everything but the index under GDPR.

Is there an interpretation of the law that allows this?

Thomas
  • 523
  • 3
  • 6

1 Answers1

2

Individual search results can certainly include your personal data. Nevertheless, excluding these from the response to a data subject access request seems sensible. Possible arguments:

  • The information in search results is not associated with your account; consequently a copy of the data in the account does not include search results.

  • You can obtain a copy of this data yourself by using the search functionality, it is therefore unnecessary to include it in a download. (Note that the right to data portability is often conflated with the right to access, but access does not require a machine-readable format.)

  • Personal data in search results is difficult to attribute to a particular person since multiple people might have the same name and one person might use multiple names. To avoid the inclusion of wrong information, such attribution should only be done manually.

  • The data in search results is only processed as textual data, not as personal data. (Not quite true since websites might be literally linked to a person, but that isn't the case in general.) Similarly, a postal service does not process the personal data in the mail they deliver.

  • A request to access to the search index is unfounded and excessive, and may therefore be refused.

Google does somewhat implement the right to be forgotten, but correctly points out that their index merely reflects the websites on the internet, and to actually remove the data you need to get it taken down from the websites that published it.

amon
  • 24,244
  • 3
  • 46
  • 77