A business directory listing website scraped old data for their listings. They use random contact information, personally identifiable information (PII), logos/banners to falsely represent those business listings and individuals.

That directory listing website presents itself as a self submission service but those listings are listed without owners permissions and valid contact information.

Simply, that directory listing website is just to generate impressions for ads revenue. The contact info stated on their website is invalid.

What legal actions can an individual take to have the listing that contains PII to be removed from such directory website? Does the use of random banners/logos to misrepresent those listings have any copyright infringement issues?

-- Added Info ---

  • Based on a search, the directory website should be hosted at Deutschland.

  • It scraped data from all over the world. It has a very huge database of domains(active and expired) but most of the information is invalid.

  • It looks more like a bogus directory website than anything. The last edit of privacy policy was in early 2018 in which the operation is different from what it claims. The listed contact information is invalid too.

Are there anything to be done in this scenario?

  • 3
    Where is the website hosted? Where are the people whose PII is listed located? Does the GDPR or another data protection law apply? Please edit the question to add this info. Dec 13, 2022 at 13:37
  • Are you sure the information was invalid in 2018? it's entirely possible that the website's company stopped in 2018 and its domain is prepaid till years later and just remains in its old state till the domain expires.
    – Trish
    Dec 14, 2022 at 22:43
  • @Trish I'm not sure which information you are referring to? A live website requires not only domain but also hosting. Anyway, the domain is renewed in 2022.
    – Skies
    Dec 14, 2022 at 22:49
  • Websites can be bought long contract wise, just like hosting. People own websites and forgot they even exist still. Companies have been dissolved for years but their bank account - abandoned but not properly closed - might still pay recurring fees for several years. Automatic renewal does not take any action in case the registrar and hoster can just debit the existing account or the account was filled with money for later use.
    – Trish
    Dec 14, 2022 at 22:52
  • What I am trying to say is, you allege the website is actively looking for information now. But you also allege the website was last updated about 2018. Which might be the last time the site ever was current and the information would have been correct in 2018.
    – Trish
    Dec 14, 2022 at 22:54

1 Answer 1


What legal actions can an individual take to have the listing that contains PII to be removed from such directory website?

You can take action under the UK GDPR.


  • The processing falls within the territorial scope in Article 3.
  • The data falls within the definition of "personal data" under Article 4(1).
  • The controller doesn't have any of the six lawful bases for processing the personal data under Article 6(1).

In that case you have the right to require the controller to erase the data under Article 17. Article 12 contains details of how controllers must handle such requests.

The request would most likely be made under Article 17(1)(d) i.e. that the controller never had a lawful basis to process the data in the first place. Alternatives include Article 17(1)(a) (the controller had a lawful basis but the processing is no longer necessary under that basis) or Article 17(1)(b) (the only lawful basis was consent and you are withdrawing your consent).

Under Article 12(3) the following deadlines apply for the controller to action your request:

  1. The controller must always action it without undue delay.
  2. Even if the controller can justify a delay, there is an upper time limit of 1 month.
  3. That can be extended to 2 months for complex requests provided that you are notified within 1 month.
  4. The clock can be paused under Article 12(6) if the controller has reasonable doubts about your identity and requests further information from you.

After the applicable deadline has passed, you have two options:

  1. Complain to the regulator under Article 77. In the UK the regulator is the ICO and you can make a complaint here. Under Article 58, the ICO can, among other powers, order the controller to erase the data. It can also impose a fine of up to £17,500,000 or 4% of annual turnover under Article 83(5). Complaining to the ICO is often preferred as it is free and without risk to the complainant.

  2. Seek an injunction in the courts under Article 79. That is done by applying to the County Court for a compliance order under Sections 167 and 180(1)(a) of the Data Protection Act 2018. If you go down this route you will have to pay court fees which you may not recover if you lose. You may also risk paying the other party's costs.

Very similar rules apply to the EU. The main difference is that you need to look at the EU GDPR instead of the UK GDPR.

  • Thank you! That's very informative and helpful!
    – Skies
    Dec 20, 2022 at 4:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .