4 ms·

>one could argue that they (security trails) don't have to remove the data. It doesn't work that way. The "right to be forgotten" can be used to remove search

>one could argue that they (security trails) don't have to remove the data. It doesn't work that way. The "right to be forgotten" can be used to remove search results from Google, even if the original content stays up.

togus 9y ago
Interesting! From a quick google the following wikipedia citation seems to what you are referring to: Grounds for removal include cases where the search result(s) "appear to be inadequate, irrelevant or no longer relevant or excessive in the light of the time that had elapsed."[1] Under GDPR, Security trails (company or person that operates it) could be classified as a "Data controller" [2] and then would of course be liable to delete information gathered about a person upon request and when the data is deemed to be "inadequate, irrelevant or no longer relevant or excessive". So for example, John Doe wants to remove the historic information that he used to own porn.com which he doesn't anymore. However, I do not think it's clear that you have to delete the data for the current owner of porn.com due to his or hers need for privacy as long as they have collect the information lawfully. As an actual advice to the people at security trails I would recommend they put up clear instructions on how to request a data erasure from their database. Like "Email erasure@securitytrails.com to request removal of your personal information" and what information they need to delete it. [1] https://en.wikipedia.org/wiki/Google_Spain_v_AEPD_and_Mario_Costeja_Gonz%C3%A1lez https://en.wikipedia.org/wiki/Google_Spain_v_AEPD_and_Mario_... [2] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... Edit: formatting
- ratherbefuddled 9y ago
  Actually the first thing Security Trails have to do is to figure out under which legal basis they think they have the right to process personal data. This is fundamental to figuring out their duties. I strongly suspect they don't have a legal basis in GDPR terms and therefore would need to rely on consent. The much publicised "right to be forgotten" is the very least of their worries.

togus 9y ago

Interesting! From a quick google the following wikipedia citation seems to what you are referring to: Grounds for removal include cases where the search result(s) "appear to be inadequate, irrelevant or no longer relevant or excessive in the light of the time that had elapsed."[1] Under GDPR, Security trails (company or person that operates it) could be classified as a "Data controller" [2] and then would of course be liable to delete information gathered about a person upon request and when the data is deemed to be "inadequate, irrelevant or no longer relevant or excessive". So for example, John Doe wants to remove the historic information that he used to own porn.com which he doesn't anymore. However, I do not think it's clear that you have to delete the data for the current owner of porn.com due to his or hers need for privacy as long as they have collect the information lawfully. As an actual advice to the people at security trails I would recommend they put up clear instructions on how to request a data erasure from their database. Like "Email erasure@securitytrails.com to request removal of your personal information" and what information they need to delete it. [1] https://en.wikipedia.org/wiki/Google_Spain_v_AEPD_and_Mario_Costeja_Gonz%C3%A1lez https://en.wikipedia.org/wiki/Google_Spain_v_AEPD_and_Mario_... [2] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... Edit: formatting

ratherbefuddled 9y ago
Actually the first thing Security Trails have to do is to figure out under which legal basis they think they have the right to process personal data. This is fundamental to figuring out their duties. I strongly suspect they don't have a legal basis in GDPR terms and therefore would need to rely on consent. The much publicised "right to be forgotten" is the very least of their worries.