3

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling.

Following this, I make the assumption that this qualifies as personal data under GDPR since my name and first name uniquely identify me as far as it can be tested.

When I request my personal data from google, I got about 2gb. Mostly my emails and, in the end, nothing really valuable.

I'm using iOS for all mobile activity and I don't have chrome, so it probably limited data capture.

The surprise was that they had a list of flights I made and I'm not sure how this was captured.

But my question is about the index: I can be found under the index and my name, the "personal data", has to be part of their database index.

So, under GDPR, I should get a copy of the index entries when my name appears, shouldn't I?

Also, if this constitute "personal data", shouldn't I have the ability to request either:

  • deletion, under the right to be forgotten
  • or, stop processing, where they can keep data but not use it?

It looks like Google is considering everything but the index under GDPR.

Is there an interpretation of the law that allows this?

  • Why just public information? What about the information other people hold about you in their Gmail or Google Drive accounts? – user4210 Jul 7 at 21:19
  • @Moo, it's a good point; interestingly, when they gave me my list of contacts, I had a list of thumb photos, for each contact, but no name / contact info. – Thomas Jul 7 at 22:35
1

Individual search results can certainly include your personal data. Nevertheless, excluding these from the response to a data subject access request seems sensible. Possible arguments:

  • The information in search results is not associated with your account; consequently a copy of the data in the account does not include search results.

  • You can obtain a copy of this data yourself by using the search functionality, it is therefore unnecessary to include it in a download. (Note that the right to data portability is often conflated with the right to access, but access does not require a machine-readable format.)

  • Personal data in search results is difficult to attribute to a particular person since multiple people might have the same name and one person might use multiple names. To avoid the inclusion of wrong information, such attribution should only be done manually.

  • The data in search results is only processed as textual data, not as personal data. (Not quite true since websites might be literally linked to a person, but that isn't the case in general.) Similarly, a postal service does not process the personal data in the mail they deliver.

  • A request to access to the search index is unfounded and excessive, and may therefore be refused.

Google does somewhat implement the right to be forgotten, but correctly points out that their index merely reflects the websites on the internet, and to actually remove the data you need to get it taken down from the websites that published it.

  • Regarding the last point, if I consent that site 'x' has a copy of a discussion I had with someone else, in which I disclose personal information, it doesn't mean I consent for google to have a copy of that same discussion. The fact it is public data doesn't mean I consent for google to hold a copy of it; To me, it feels like the 'public data' reasoning is a way for them to try to escape responsibility. – Thomas Jul 7 at 22:39
  • 4
    @Thomas I'd have to disagree with you there - restricting use of public information in the way you describe would utterly destroy the internet. The GDPR (and the right to be forgotten) is bad enough as it is, but your approach there is well beyond that - public data is public data, and anyone who can access it should be able to use it. You are basically saying that every site on the internet should be a closed community akin to Facebook (where site indexing is prohibited unless you have explicit permission), AOL or Compuserve. – user4210 Jul 7 at 23:03
  • no, I understand the value of sharing data, but at the same time I think a person's privacy is more important. For example, 10 years ago I had a public conversation in a bar, everyone around could hear it. But only a few people were present. Now someone decides to go back in time and make that conversation public to people that didn't even know me back then. In my eyes it is generally ok, unless a party to that conversation objects. If I post something on a site, most of the world doesn't know about it, but google decides that the world should know about it and I have nothing to say about it – Thomas Jul 7 at 23:08
  • 1
    @Thomas if you have issue with inaccurate information, then the "right to be forgotten" is the avenue with which you take to correct the public record. As Greendrake says, Google didnt make anything public, they took public information and made it searchable - thats a very different situation. Google isnt broadcasting anything, there is no feed to which everyone is subscribed to on which this information is published, it doesnt appear in a Google version of a Facebook feed - they are taking public information and pointing people to it when they enter certain search terms. Thats fine. – user4210 Jul 8 at 0:24
  • 2
    @Thomas you are trying to apply the basics of personal space to the internet - that doesnt work, and will never work, and in any case there is utterly nothing you can do from stopping anyone in your personal space from publishing that conversation to the internet. Your view on what Google is doing is utterly utterly wrong as a result. Google isnt cataloging anyones trashcans, they are cataloging things people have put up on notice boards for anyone to read. – user4210 Jul 8 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.