Reclaiming sovereignty over your own data – information, correction and deletion in the digital age

People now leave digital traces in almost every area of daily life, because personal information is constantly collected, stored and evaluated when shopping, reading messages, exchanging information with friends and going to the authorities. Many find it uncomfortable that all this individual information creates an increasingly accurate picture of one’s own person,which can be used for advertising, for assessing creditworthiness or for completely different purposes. For this reason, the European Community has decided to set firm limits on the handling of such information, which apply equally to all Member States, and to provide individuals with effective tools with which to exercise sovereignty over their ownThe following text presents the most important of these tools and explains how each individual can make practical use of their right of access, correction and deletion without having to have legal expertise.

The Single European Data Protection Regulation

Since the entry into force of the European General Data Protection Regulation, a uniform legal framework for the handling of personal data has been in place in all countries of the European Community. The aim of this regulation is to raise the protection of personal information to a common, high standard and to give all people everywhere the same rights vis-à-vis thosewho process their data. The very concept of the data subject speaks a clear language, because it makes it clear that anyone who discloses their personal information can potentially become a victim of those who process and evaluate this information. That this impression is not completely wrong is shown by the numerous examples of the recent past,where data has been passed on, sold or otherwise misused without the knowledge and will of the people.

The right to information as an effective tool

In addition to the already mentioned possibilities of reducing the amount and dissemination of your own data from the outset, the regulation grants a large number of other rights, among which the right to information occupies an outstanding position. Any data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or herif this is the case, she also has a comprehensive right of access to this personal data so that she can get a complete picture of what is stored about her. Following this basic confirmation, the ordinance sets out in detail which individual information the data subject can request information about.

The individual points of the information

This information first of all includes the purpose of the processing, because the provider must determine very precisely what he does with the data, and no use of the address for advertising purposes may be derived from the order of a product alone, unless the data subject expressly agrees. Furthermore, the categories of data can be queried, whereby similarInformation may be summarized, such as address data and payment information. In addition, there are the recipients of the data, because the consent initially only applies to the contractual partner, who, however, often uses other service providers or partner companies to whom the information is passed on. The duration of the storage must also be communicated, because the providerMust delete data as soon as he no longer needs it, whereby he can only determine the deletion period within narrow limits. Finally, the source of the data is also part of the obligation to provide information, because some information is not disclosed itself, but the provider obtains it from other sources, and it is precisely these sources that he must then disclose.

The practical way to obtain information

Anyone who acts as the owner of their personal data can request information from any service provider who processes this data in any form. The first point of contact for such a request is always the privacy policy of the respective website, which can usually be found at the bottom of the page near the imprint. At the very beginning of such a privacy policythe details of the responsible body, i.e. the company or individual who is responsible for the processing of the data. The competent supervisory authority and the contact person for data protection should also be listed there, and it is precisely these contact options that should be used if you ask questions, request information, object to storage orCorrection of the stored information.

A little patience while editing

Normally, you will receive a response at relatively short notice, indicating that your request has been received and is being processed. However, for most small and medium-sized businesses, compiling the desired data is not an automatic process that could be done at the touch of a button. The ordering system, invoicing, electronic mail and theCustomer management are often separate systems that are installed and maintained in different locations. Companies should therefore be given a little time until all the information has been compiled and submitted in full.

If the information is missing or inadequate

However, practical experience shows that many companies, including very well-known ones, do not take the obligation to provide information very seriously. Stiftung Warentest carried out a test across all industries and company sizes and found clear deficiencies. The range ranged from no information at all to incomplete to downright incorrectInformation, so that there can be no question of a nationwide exemplary behavior. Anyone who waits in vain for information for a long time or is given an inadequate answer can contact the data protection supervisory authorities and report that their right has not been complied with. The supervisory authorities will deal with this request in due course, butthis takes a relatively long time because the authorities are more than busy with reports of data breaches and with audits.

The independent query in your own account

Larger companies now offer a possibility of self-service, with which you can request the data stored about yourself in your own account. This is possible, for example, with Facebook and Amazon, both of which have set up corresponding functions for their users. At Amazon, you can find this function in the customer service area under theKeyword of data protection and the question of how to request your own data. You can either request individual data categories such as orders and your own search queries or have the complete stored data transmitted to you.

Right to rectification and erasure

But what happens if you find data in the information that is incorrect or that no longer belongs to this place, for example because the customer relationship has long since ended? In such a case, you can request the correction or deletion of the data in question in the same way. However, the right to deletion under the Regulation has an importantSpecial feature, because in simplified terms, it does not apply if storage is still necessary due to other laws. These other laws may include the Commercial Code as well as social and tax laws that impose a retention obligation on companies over a long period of time. So until your own data can be completely deleted, it can take several years,and you have to have that patience.

The net itself does not forget

What is often overlooked is the fact that not only individual providers on the Internet store personal data, but that the Internet itself has a memory. This memory is created by the search engines, which regularly create and constantly update a directory of existing websites. These search results naturally also containpersonal data that can be found by anyone in this way. Even if a single page has long since been changed, the old entry in the search engine directory can remain visible for a long time.

The pioneering case from Spain

The case of a Spanish homeowner named Mario Costeja González, who found a reference to the website of a daily newspaper under his own name many years ago, was decisive in this question. In this post, he was listed as the owner of a house that had been seized for debt, even though the debt had long since been repaid.However, searching through Google still led to this old newspaper site, and anyone looking for the man’s name had to get the impression of insolvency. After both the newspaper and Google refused to delete the references, the person concerned went to court and ended up getting it right, so Google had to delete the entries. The ability to delete such entriessince this ruling, at least all data subjects in the European Union have had this right, and of course this right does not only apply to Google.

Regularly searching for your own name

For all these reasons, it is advisable to search for your own name at regular intervals to get an overview of what the network knows about you. Since the large search engine aligns its results with the respective profile and can create a distorted image, it is advisable to use an anonymous search engine that displays the results neutrally.With such a service, it is also possible to determine from which country view the search should be carried out, which significantly improves the significance of the results. From Germany, the search results look significantly different than, for example, from the United States of America. So if you want to get as unadulterated an image of your digital traces as possible, you should search fromdifferent perspectives.

Requesting deletion of outdated search results

If you find entries about yourself in such a search that are no longer accurate, outdated or simply incorrect, and if you have a citizenship or a residence in the European Union, you can request the deletion of this entry from the search results via a special form from Google. However, one should be aware that after thisRequest takes some time until the corresponding entry is actually no longer found in the search. It is equally important to note that the same request must also be addressed to Bing and all other search engines that create their own directory and in which the objectionable search result appears.