What legal actions can we take for website that doesn't remove PII upon requests?

Question

A business directory listing website scraped old data for their listings. They use random contact information, personally identifiable information (PII), logos/banners to falsely represent those business listings and individuals.

That directory listing website presents itself as a self submission service but those listings are listed without owners permissions and valid contact information.

Simply, that directory listing website is just to generate impressions for ads revenue. The contact info stated on their website is invalid.

What legal actions can an individual take to have the listing that contains PII to be removed from such directory website? Does the use of random banners/logos to misrepresent those listings have any copyright infringement issues?

-- Added Info ---

• Based on a search, the directory website should be hosted at Deutschland.

• It scraped data from all over the world. It has a very huge database of domains(active and expired) but most of the information is invalid.

• It looks more like a bogus directory website than anything. The last edit of privacy policy was in early 2018 in which the operation is different from what it claims. The listed contact information is invalid too.

Are there anything to be done in this scenario?

Answer 1

england-and-wales

What legal actions can an individual take to have the listing that contains PII to be removed from such directory website?

You can take action under the UK GDPR.

Assumptions:

• The processing falls within the territorial scope in Article 3.
• The data falls within the definition of "personal data" under Article 4(1).
• The controller doesn't have any of the six lawful bases for processing the personal data under Article 6(1).

In that case you have the right to require the controller to erase the data under Article 17. Article 12 contains details of how controllers must handle such requests.

The request would most likely be made under Article 17(1)(d) i.e. that the controller never had a lawful basis to process the data in the first place. Alternatives include Article 17(1)(a) (the controller had a lawful basis but the processing is no longer necessary under that basis) or Article 17(1)(b) (the only lawful basis was consent and you are withdrawing your consent).

Under Article 12(3) the following deadlines apply for the controller to action your request:

1. The controller must always action it without undue delay.
2. Even if the controller can justify a delay, there is an upper time limit of 1 month.
3. That can be extended to 2 months for complex requests provided that you are notified within 1 month.
4. The clock can be paused under Article 12(6) if the controller has reasonable doubts about your identity and requests further information from you.

After the applicable deadline has passed, you have two options:

1. Complain to the regulator under Article 77. In the UK the regulator is the ICO and you can make a complaint here. Under Article 58, the ICO can, among other powers, order the controller to erase the data. It can also impose a fine of up to £17,500,000 or 4% of annual turnover under Article 83(5). Complaining to the ICO is often preferred as it is free and without risk to the complainant.

2. Seek an injunction in the courts under Article 79. That is done by applying to the County Court for a compliance order under Sections 167 and 180(1)(a) of the Data Protection Act 2018. If you go down this route you will have to pay court fees which you may not recover if you lose. You may also risk paying the other party's costs.

Very similar rules apply to the EU. The main difference is that you need to look at the EU GDPR instead of the UK GDPR.