A scholarship organization is publishing my personal information on their website

Question

In February 2018, I received a one-time scholarship (1000 €) from a private association in the EU. A few months ago, I noticed the organization published on their website private information of the scholarship recipients: name, town and photography of each person.

This is a problem for me, because this appears on the first page of results when I search my name on Google. This means, everyone who looks up my name on Google will be able to know where I live. This is even more a problem, because I live in a small town, so it is very easy to deduce my house address.

I had emailed the association, and I was told they were "not even sure they could technically remove the information" because "this is the first time we received such a request" and "no scholarship recipient ever had a problem with this".

This was a few months ago, and my personal information is still published on their website.

I would still prefer to have this information removed. How should I politely approach this situation?

Answer 1

This is clearly personal information (PI) , and indeed personally identifiable information (PII). and so is Personal Data under the GDPR.

Under Article 6 of the GDPR any processing must have a lawful basis. There are 6 possible bases. The most likely ones here would be (a) consent, or (f) legitimate interst, but the private association may claim some other basis as well. They should tell you what basis or bases justify their processing of this information, which includes storing it and publishing it.

Under Article 13, Paragraph 1(c) the association should have informed you of the purposes for which information was collected when it was first collected.

Under Article 15 paragraph 1 you are entitled to request and obtain from the association (or any other Data Controller) a statement of what PI about you they hold. along with this they must supply various other information including;

• (a) the purposes of the processing;
• (b)the categories of personal data concerned;
• (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• (f) the right to lodge a complaint with a supervisory authority;

and other specified information.

Article 17 paragraph 1 provides that:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ...

if one the the specified conditions applies, particularly:

• 1(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
• 1(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2)

Article 21 paragraph 1 provides that:

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Thus I would suggest that you send a written communication to the association, stating that you:

1. Request access to all PI which they have about you, as permitted by GDPR article 15 paragraph 1;
2. Request that they delete any such information from the public website and any other publications, as permitted by GDPR article 17 paragraph 1;
3. State that you object to further processing of this information under GDPR article 21 paragraph 1;
4. Request information on the name and contact info of the relevant supervisory authority under GDPR article 15 paragraph 1;
5. State that you expect these requests to be complied with promptly, in no event later than 30 days. Mention your prior request for the public info to be deleted, and that several months have already elapsed. Give the exact date of the prior request.

I would suggest sending these requests, together in a single email, specifically mentioning the relevant GDPR provisions. I would suggest sending a copy of this by registered mail, and retaining a copy, along with the identifying number of the registered letter. In the letter, mention the email.

If the association does not promptly respond in a way you consider satisfactory, you may wish to file a complaint with the relevant data protection supervisory authority. You may also wish to consult a lawyer with experience in this area to determine if you have any legal recourse if the association does not comply.