3

In February 2018, I received a one-time scholarship (1000 €) from a private association in the EU. A few months ago, I noticed the organization published on their website private information of the scholarship recipients: name, town and photography of each person.

This is a problem for me, because this appears on the first page of results when I search my name on Google. This means, everyone who looks up my name on Google will be able to know where I live. This is even more a problem, because I live in a small town, so it is very easy to deduce my house address.

I had emailed the association, and I was told they were "not even sure they could technically remove the information" because "this is the first time we received such a request" and "no scholarship recipient ever had a problem with this".

This was a few months ago, and my personal information is still published on their website.

I would still prefer to have this information removed. How should I politely approach this situation?

5
  • 4
    Is it possible that you agreed to this as a condition of receiving the scholarship?
    – jwh20
    Commented Jan 4, 2022 at 16:06
  • It would be important to figure out what the paperwork at the time said, and perhaps where the association is from (GDPR wasn't in force at the time, but there were similar national rules in every EU member). Continued processing via their website definitely falls under GDPR. If they are using your data under a legitimate interest, you can object to further processing on grounds relating to your particular situation (see Art 21 GDPR). I think such an objection should be successful. Based on that objection you can request erasure (Art 17 GDPR). This does not affect their internal records.
    – amon
    Commented Jan 4, 2022 at 16:16
  • @jwh20 Even if there was such an agreement, the consent can probably be withdrawn. Commented Jan 4, 2022 at 16:19
  • I honestly think that being concerned about this is grossly unreasonable and ungrateful. These are basic things that someone granting a scholarship should be allowed to display to market the scholarship. But I don't know GDPR well and maybe EU norms are different. I defer to my betters on that score.
    – ohwilleke
    Commented Jan 4, 2022 at 21:02
  • @ohwilleke Whether one ought to be concerned about such a thing is not a legal matter. Many in the US would object to their name, image and address being published on a website for any purpose at all. I don't- I post here under my legal name, and my image is on my LinkedIn page and my Wikipedia page. But the GDPR seems to give a person the right to object to such a listing, whether or not it is wise or just to use that right. Commented Jan 4, 2022 at 21:50

1 Answer 1

4

This is clearly personal information (PI) , and indeed personally identifiable information (PII). and so is Personal Data under the GDPR.

Under Article 6 of the GDPR any processing must have a lawful basis. There are 6 possible bases. The most likely ones here would be (a) consent, or (f) legitimate interst, but the private association may claim some other basis as well. They should tell you what basis or bases justify their processing of this information, which includes storing it and publishing it.

Under Article 13, Paragraph 1(c) the association should have informed you of the purposes for which information was collected when it was first collected.

Under Article 15 paragraph 1 you are entitled to request and obtain from the association (or any other Data Controller) a statement of what PI about you they hold. along with this they must supply various other information including;

  • (a) the purposes of the processing;
  • (b)the categories of personal data concerned;
  • (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • (f) the right to lodge a complaint with a supervisory authority;

and other specified information.

Article 17 paragraph 1 provides that:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ...

if one the the specified conditions applies, particularly:

  • 1(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
  • 1(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2)

Article 21 paragraph 1 provides that:

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Thus I would suggest that you send a written communication to the association, stating that you:

  1. Request access to all PI which they have about you, as permitted by GDPR article 15 paragraph 1;
  2. Request that they delete any such information from the public website and any other publications, as permitted by GDPR article 17 paragraph 1;
  3. State that you object to further processing of this information under GDPR article 21 paragraph 1;
  4. Request information on the name and contact info of the relevant supervisory authority under GDPR article 15 paragraph 1;
  5. State that you expect these requests to be complied with promptly, in no event later than 30 days. Mention your prior request for the public info to be deleted, and that several months have already elapsed. Give the exact date of the prior request.

I would suggest sending these requests, together in a single email, specifically mentioning the relevant GDPR provisions. I would suggest sending a copy of this by registered mail, and retaining a copy, along with the identifying number of the registered letter. In the letter, mention the email.

If the association does not promptly respond in a way you consider satisfactory, you may wish to file a complaint with the relevant data protection supervisory authority. You may also wish to consult a lawyer with experience in this area to determine if you have any legal recourse if the association does not comply.

1
  • Also googles own takedown procedure so it isn't cached in common searches too
    – Stilez
    Commented Jan 7, 2022 at 10:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .