CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ121

Compliance with European Data Protection Law and Regulation

A German data subject was the target of an embarrassing prank 20 years ago. At that time, a newspaper website published an article about the prank, and the article remains available on the newspaper’s website. Unfortunately, the prank is the highest search result when a user searches for the victim’s name. The data subject asks SearchCo to delist the result. SearchCo agrees and directs its technology team not to scan or index the article. What else is SearchCo required to do?

  • A Notify the newspaper that its article it is delisting the article.
  • B Fully erase the URL to the content, as opposed to delist which is mainly based on data subject’s name.
  • C Identify other controllers who are processing the same information and inform them of the delisting request.
  • D Prevent the article from being listed in search results no matter what search terms are entered into the search engine.
Explanation

Under GDPR Article 17(2), a controller that has made personal data public and is required to erase it must take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested erasure of links to, copies of, or replications of that data. A search-engine operator is a controller for its indexing and result-display processing. Delisting does not itself require deletion of the publisher’s original article or blocking the article for all possible search terms.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!