1

Take a search engine (e.g. Google), where user A can make searches without logging in with their account. The search engine collects, processes and stores, over time, a number of data about the user A, such as cookies identifiers, IP address, browsers fingerprint, and the search strings. I think all these are "Personal Data" according to GDPR (right?). How could user A exercise his right of access to these data? In particular:

  • how could user A compile such a SAR, given that the search engine has no identifiable information other than the cookie ID (something like "please supply the personal data you hold about me, identified by cookie ID X"?)

  • how could user A demonstrate he is the real owner of those data (and not someone else using the same device/connection)

Improve this question

1 Answer 1

Reset to default
1

I think all these are "Personal Data" according to GDPR (right?)

Can the data controller or another person, "with reasonable means reasonably likely to be used," use that data alone or in combination with other data to identify a natural person?

If yes, it is personal data within the meaning of the GDPR.

If no, it is not personal data within the meaning of the GDPR.

how could user A compile such a SAR, given that the search engine has no identifiable information other than the cookie ID (something like "please supply the personal data you hold about me, identified by cookie ID X"?)

If the cookie ID is personal data, surely the cookie ID would be sufficient? If it is personal data, in that it may tie together data that in some combination can identity a natural person.

how could user A demonstrate he is the real owner of those data (and not someone else using the same device/connection)

The data controller is permitted to ask you for information or evidence of your identity (but only such information or evidence as is necessary).

Improve this answer
7
  • This is a difficult issue and one the GDPR hasn’t been tested on - the GDPR already considers things like an IP address or a cookie identifier as PII, but that doesn’t necessarily mean that Google can track them back to an individual in perpetuity, as both are transient (you can change IP addresses, and indeed most people do, and you can clear your cookies or use another browser). So when those things change, Google is still holding data which is technically PII under the GDPR but completely disconnected from reality. And when using a shared computer, this complicates matters even more.
    – user28517
    Mar 10, 2020 at 8:42
  • 1
    @Moo "the GDPR already considers things like an IP address or a cookie identifier as PII". GDPR doesn't say all IP addresses are personal data, it says (my emphasis) "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags." In some court cases IP addresses have been found to be personal data. It does not follow from that they are personal data in all circumstances. Nor can they be, logically.
    – Lag
    Mar 10, 2020 at 9:01
  • @Lag IP addresses are tricky because they are reassigned and may be shared by many persons. But an ID in a browser cookie clearly relates to an identifiable person (the person using the browser). The same ID in some database doesn't necessarily allow identification, but here GDPR Art 11(2) seems relevant: data subject rights like access don't apply by default, unless the data subject “provides additional information enabling his or her identification”. Extracting the ID from a cookie would clearly enable identification. A controller can avoid this by not storing such IDs at all.
    – amon
    Mar 10, 2020 at 10:17
  • "The data controller is permitted to ask you for information or evidence of your identity" how to demonstate I was the one actually using the browser when data were collected (and associated to the stored cookie ID), and not my sibling?
    – kuma
    Mar 10, 2020 at 14:58
  • @kuma Indeed. So they might ask you questions about your behaviour on a given date that they can relate to the data they hold.
    – Lag
    Mar 10, 2020 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .