6

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling.

Following this, I make the assumption that this qualifies as personal data under GDPR since my name and first name uniquely identify me as far as it can be tested.

When I request my personal data from google, I got about 2gb. Mostly my emails and, in the end, nothing really valuable.

I'm using iOS for all mobile activity and I don't have chrome, so it probably limited data capture.

The surprise was that they had a list of flights I made and I'm not sure how this was captured.

But my question is about the index: I can be found under the index and my name, the "personal data", has to be part of their database index.

So, under GDPR, I should get a copy of the index entries when my name appears, shouldn't I?

Also, if this constitute "personal data", shouldn't I have the ability to request either:

  • deletion, under the right to be forgotten
  • or, stop processing, where they can keep data but not use it?

It looks like Google is considering everything but the index under GDPR.

Is there an interpretation of the law that allows this?

Improve this question
2
  • 1
    Why just public information? What about the information other people hold about you in their Gmail or Google Drive accounts?
    – user4210
    Jul 7, 2019 at 21:19
  • @Moo, it's a good point; interestingly, when they gave me my list of contacts, I had a list of thumb photos, for each contact, but no name / contact info.
    – Thomas
    Jul 7, 2019 at 22:35

1 Answer 1

Reset to default
2

Individual search results can certainly include your personal data. Nevertheless, excluding these from the response to a data subject access request seems sensible. Possible arguments:

  • The information in search results is not associated with your account; consequently a copy of the data in the account does not include search results.

  • You can obtain a copy of this data yourself by using the search functionality, it is therefore unnecessary to include it in a download. (Note that the right to data portability is often conflated with the right to access, but access does not require a machine-readable format.)

  • Personal data in search results is difficult to attribute to a particular person since multiple people might have the same name and one person might use multiple names. To avoid the inclusion of wrong information, such attribution should only be done manually.

  • The data in search results is only processed as textual data, not as personal data. (Not quite true since websites might be literally linked to a person, but that isn't the case in general.) Similarly, a postal service does not process the personal data in the mail they deliver.

  • A request to access to the search index is unfounded and excessive, and may therefore be refused.

Google does somewhat implement the right to be forgotten, but correctly points out that their index merely reflects the websites on the internet, and to actually remove the data you need to get it taken down from the websites that published it.

Improve this answer
17
  • 1
    Regarding the last point, if I consent that site 'x' has a copy of a discussion I had with someone else, in which I disclose personal information, it doesn't mean I consent for google to have a copy of that same discussion. The fact it is public data doesn't mean I consent for google to hold a copy of it; To me, it feels like the 'public data' reasoning is a way for them to try to escape responsibility.
    – Thomas
    Jul 7, 2019 at 22:39
  • 4
    @Thomas I'd have to disagree with you there - restricting use of public information in the way you describe would utterly destroy the internet. The GDPR (and the right to be forgotten) is bad enough as it is, but your approach there is well beyond that - public data is public data, and anyone who can access it should be able to use it. You are basically saying that every site on the internet should be a closed community akin to Facebook (where site indexing is prohibited unless you have explicit permission), AOL or Compuserve.
    – user4210
    Jul 7, 2019 at 23:03
  • 1
    no, I understand the value of sharing data, but at the same time I think a person's privacy is more important. For example, 10 years ago I had a public conversation in a bar, everyone around could hear it. But only a few people were present. Now someone decides to go back in time and make that conversation public to people that didn't even know me back then. In my eyes it is generally ok, unless a party to that conversation objects. If I post something on a site, most of the world doesn't know about it, but google decides that the world should know about it and I have nothing to say about it
    – Thomas
    Jul 7, 2019 at 23:08
  • 1
    Where I take issue is that they make an unilateral decision about things that were done in a specific context (site in this case), would be forgotten, and bring them back to life in a totally unrelated context. In my specific case, there is some inaccurate information regarding my family that was posted by an ex in 2006 on a forgotten, but still online blog. It hasn't been updated for more than 10 years, the admin is not there anymore, it's a zombie hosting account with no visitors, but google decided this should be public and brought up to anyone that would look me up.
    – Thomas
    Jul 7, 2019 at 23:14
  • 2
    @Thomas you are trying to apply the basics of personal space to the internet - that doesnt work, and will never work, and in any case there is utterly nothing you can do from stopping anyone in your personal space from publishing that conversation to the internet. Your view on what Google is doing is utterly utterly wrong as a result. Google isnt cataloging anyones trashcans, they are cataloging things people have put up on notice boards for anyone to read.
    – user4210
    Jul 8, 2019 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .