-1

GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on my account.)

P.S. Every year hundreds of thousands of users are banned by Google based on automated checks. Here a Google employee confirms they banned over 200 000 thousand accounts alone in 2015.

  • 3
    If the agreement between you and Google AdWords constitute a contract, then you have no right under the GDPR for erasure of your personal data. Alternatively, under Article 47, preventing fraud and abuse of service is an enduring legitimate interest that is not overridden by the right of erasure - they can maintain enough information to ensure your ban remains effective. – user4210 Mar 6 at 4:28
  • Sry, but there is no more agreement as I no longer consent for my data to be controlled by Google. Also, Article 47 states that "provided that the interests or the fundamental rights and freedoms of the data subject are not overriding". Using my data in such a way is fraudulent and abusive. Will check with the EU Data Protection authority. – giorgio79 Mar 6 at 15:12
  • 1
    If the ban was not lawful, you have to fight the ban itself. Otherwise, if Google would not be able to keep your data, a ban would have no effect. Your fundamental rights and freedoms are not violated, because you have caused the ban yourself. In other words, Google processes your personal data based on Art. 6(1)(f). Art. 21(1) does not apply because Google has compelling legitimate grounds for the processing. That also means that Art. 17(1) does not apply. – wimh Mar 6 at 18:23
  • 5
    @giorgio79 no, it's not fraudulently abusive - in fact, what you are stating you wish to accomplish is fraudulent and abusive, and Google has a legitimate interest that does override your interests and freedoms here - that of preventing you abusing the service it provides. Your right to be forgotten and your right to withdraw consent are not overriding rights in all cases and Google can most definitely make a case for a legitimate overriding and enduring interest here. – user4210 Mar 6 at 19:22
  • 2
    @giorgio79 so what if it's "tech"? You got banned, and you are asking about using the GDPR to evade that ban - the answer is that you can't, Google has legitimate interests to refuse a complete implementation of your right to be forgotten. Google does ban ads it doesn't like, but it also bans accounts that abuse the service. – user4210 Mar 9 at 4:58
7

The GDPR's right to erasure is not absolute. Simplifying things a bit, you only have this right if

  • the legal basis for processing was consent, because consent can be revoked freely; or
  • the legal basis for processing was legitimate interest and the controller does not have an overwhelming legitimate interest in keeping the data.

Legitimate interest always requires that the controller's legitimate interest and the data subject's rights and interests are balanced. A request for erasure shifts this balance but does not decide it.

In practice, a request for erasure may be denied if

  • the controller has legal obligations to keep this data, for example financial records; or
  • the continued processing of this data is necessary for performance of a contract; or
  • the controller has an overriding legitimate interest in continued process of the data.

Note that contracts may have effects that survive termination of the contract. Note also that a contract might not involve the data subject as a party to the contract, the classic example being a postal delivery contract that necessarily requires processing of the recipient's personal data.

In your specific example it seems that the legal basis was legitimate interest and that the data controller has an overwhelming legitimate interest to hold on to parts of your data for the purpose of fraud prevention.

If you feel like the continued processing of the data is illegal, for example because the legitimate interest balancing was done incorrectly, or because the legal basis was consent, then you have the following remedies:

  • You can lodge a complaint with the responsible supervisory authority.
  • You can sue the controller before a responsible court for compliance, and for the (actual) damages that you suffered as a result from illegal processing.

I'll point out that neither of these approaches is likely to work for you, because abuse/fraud prevention appears like a pretty standard case of overwhelming legitimate interest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.