An Coimisiún um Chosaint Sonraí
Data Protection Commission
DPC Ref:
DPC Complaint Ref:
Date: 15 November 2023
Complainant:
Data Controller: Microsoft Operations Ireland Limited
RE: Microsoft Operations Ireland Limited
# DECISION
This document is a Decision of the Data Protection Commission ("DPC") in relation to DPC Complaint reference hereinafter referred to as the ("Complaint"), submitted by ("Complainant") against Microsoft Operations Ireland Limited ("Microsoft") to the DPC in its capacity as the lead supervisory authority ("LSA").
This Decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
# Communication of Draft Decision to "supervisory authorities concerned"
In accordance with Article 60(3) GDPR, the DPC was obliged to communicate the relevant information and submit a draft decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the matter to the "supervisory authorities concerned". As Microsoft offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as LSA identified that each supervisory authority is a supervisory authority concerned, as defined in Article 4(22) GDPR. On this basis, the Draft Decision of the DPC in relation to this Complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
# Complaint Handling by the DPC – Timeline and Summary
1. The Complaint that is the subject of this Decision concerns alleged infringements of Articles 12 and 17 of the GDPR in relation to erasure requests submitted to the Controller.
2. On 8 April 2021, the Complainant made a complaint to the Bavarian SA (Bavarian Lander Office for Data Protection Supervision). The Complainant stated he had made an erasure request to Microsoft regarding a website and other data he wished to be deleted from Microsoft's search engine, stating: "I have, among other things, a website that is connected to . I wrote to Microsoft to delete data from its search machine." The Complainant stated he received links to forms to fill out, that he had to give personal data and attach a copy of his ID card. The Complainant informed the Bavarian SA that Microsoft refused to delete all the requested search results due to public interest. He said he did not agree with this because it was "a matter of private interest, copyright and the desire for erasure". The Complainant noted he was then led to "a
1
An Coimisiún um Chosaint Sonraí
Data Protection Commission
computer assistant who did not understand what I wrote". This led the Complainant to write a letter to Microsoft's office in Munich with his erasure request. In his Complaint to the Bavarian SA, the Complainant reiterated his erasure request, and stated "I now want all my data to be erased by this company (including from all search engines)".
3. The DPC received the Complaint from the Bavarian SA on 28 July 2021.
4. Based on the correspondence provided to the DPC by the Bavarian SA on this date and in subsequent engagement to clarify some matters, the DPC understands the chronology of events up to this point to be as follows:
- On at least one occasion prior to 26 March 2021, the Complainant made an erasure request to Microsoft pursuant to Article 17 of the GDPR. The original request or requests have not been made available to the DPC.
- On 26 March 2021 Microsoft Customer Support responded to what appears to have been a prior email from the Complainant. This email instructed him on the procedure to close an account. Microsoft provided him with a link outlining instructions and stating: "The owner of the Microsoft account is the only person able to manage the account, i.e. I cannot and cannot [sic] close the account for you. Accounts are automatically closed after 2 years of inactivity, but if you want to do so, please follow these instructions".
- Later on 26 March 2021, the Complainant submitted an erasure request to Microsoft for the deletion of all pages, data and files in "the search engine" (i.e. the Bing search engine operated by Microsoft). This request of 26 March 2021 appears to have been made by email to a Microsoft Customer Support channel. This email stated that the request was not related to an account, but was about "data protection in general". It added: "You have received data from me, among other things, with regard to: Deletion of pages and files in the search engine; Which I want to have deleted and confirmed." While the Complainant stated in this message that requested deletion of pages and files in the search engine was his "4th email", no documentation indicating earlier contact with Microsoft than 26 March 2021 was provided in support of the Complaint.
- On 27 March 2021, Microsoft (via the [REDACTED]@microsoft.com address) emailed the Complainant to inform him that it would remove two URLs from Bing search results following a request from him. These were the following:
(i) Https://www.[redacted]
(ii) https://www.xing.com/profile/[redacted]
- Microsoft stated that in relation to two other URLs, it would take no action as it had decided that the public interest "outweighs your interest in privacy". The items Microsoft stated it would not delete were a link to a Bing search result which returned results based on the Complainant's name, and search hits associated with the website www.[redacted].de
- On 10 May 2021 the Complainant appears to have submitted an update request to Microsoft by email stating: "I would once again ask you to delete all stored and collected data from your systems irrevocably and completely...This includes all data including files sent for the following deletion request: Microsoft Bing." The Complainant included a reference number which he stated related to his previous erasure request.
2
An Coimisiún um Chosaint Sonraí
Data Protection Commission
- On 13 May 2021 Microsoft Customer Support appears to have responded and provided a link to instructions to close a Microsoft account.
5. On 9 October 2021, the Complainant contacted the Bavarian SA in response to DPC queries issued to the Complainant by the Bavarian SA on 23 September 2021. The Complainant noted his erasure request had not been completed by Microsoft.
6. On 19 October 2021, the Bavarian SA wrote to the DPC providing additional clarification regarding three URLs linked to the Complainant which he wanted Microsoft to de-list, following further correspondence from him to that SA on 17 October 2021.
The correspondence included a copy of an email dated 17 October 2021 from Microsoft (from [REDACTED]@microsoft.com) to the Complainant. This email stated: "We have reviewed your request and determined that there is a significant public interest in accessing this information as it relates to your work life. We have therefore decided to take no action on this URL(s):
https://[redacted1].pdf
https://[redacted2].pdf
https://[redacted3].pdf"
The Complainant's email to the Bavarian SA of 17 October 2021, which was provided to the DPC, stated that the links were "openly on the net" for a year despite his requests for deletion. He said the search hits included his address, telephone number and account data. He stated that he had received extortion letters and that these were with the police. The company he owned [i.e. the company associated with the [redacted].de domain] "no longer exists", he stated. The Complainant also stated in relation to Microsoft's refusal to remove the www.[redacted].de URLs from its search hits that the company "is not able or does not want to grasp that I am the webmaster and creator".
7. On 12 November 2021, the DPC commenced the process of complaint-handling. In its commencement of complaint-handling notice to Microsoft, the DPC raised the issue of the Complainant's erasure request. The DPC noted in its commencement notice to Microsoft the Complainant wished the following URLs to be delisted from the search engine:
https://[redacted1].pdf
https://[redacted2].pdf
https://[redacted3].pdf
8. The commencement notice referred to the Complainant's adherence to Microsoft's request-for-erasure¹ procedure and his provision of personal data as part of that process, including the uploading of a copy of his identity card. The DPC noted the Complainant requested the deletion of all personal information provided in connection with his erasure request, including the copy of his ID card that the Complainant provided to Microsoft as part of the erasure request. The notice also referred to Microsoft's response to the Complainant on 17 October 2021 where it stated the
3
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
URLs could not be delisted due to a significant public interest in accessing that information as it related to the Complainant's work life.
9. The commencement notice requested that Microsoft take the following steps by 29 November 2021: (i) outline in further detail the reasons that the Complainant's request for delisting of the pertinent URLs had been refused and (ii) outline whether Microsoft had fulfilled the Complainant's erasure request in a manner it considered consistent with Article 17 of the GDPR, with supporting evidence if this was the case.
10. On 29 November 2021 Microsoft responded to the DPC and stated: "We have re-reviewed [the Complainant's] request and determined that our intake team rejected this case when it should have been accepted and the content delisted. We are working to delist the content under the EU Right to Be Forgotten now and it should be down in the coming days."
11. On 1 February 2022 the DPC wrote to Microsoft and noted it had carried out a Bing search on the Complainant's name on that date with the following URL having appeared as a result:
https://www.[redacted4].pdf
In its correspondence to Microsoft, the DPC said it recognised that this URL was not one of the [redacted].de URLs which Microsoft had already agreed to delist. The DPC said it anticipated that, in order for amicable resolution to be amenable to the data subject, this URL would also have to be delisted. The DPC asked Microsoft to confirm whether all of the Complainant's personal data (including the copy of the Complainant's identity card) had been deleted and, if not, to provide a reason as to why the deletion had not taken place. The DPC also requested whether Microsoft had fulfilled the Complainant's right to be forgotten in a manner consistent with Article 17 of the GDPR and, if so, to provide evidence of such. The DPC requested Microsoft to respond to its queries by 14 February 2022. On 14 February 2022 Microsoft confirmed to the DPC that it had accepted the URL for delisting and entered a manual request on behalf of the Complainant.
12. On 24 February 2022 the DPC wrote to Microsoft to request confirmation the personal data of the Complainant, including the copy of the Complainant's identity card, had been deleted as requested. The DPC reminded Microsoft of its communication of 1 February 2022 requesting confirmation of the deletion of the Complainant's personal data. The DPC requested Microsoft to confirm, within one week of the date of the DPC's email, the deletion of all of the Complainant's personal data and, if this had not happened, the reasons why deletion had not occurred.
13. The DPC contacted Microsoft by email on 9 March 2022 to remind it of the request stipulated in the communication of 24 February 2022 and requested Microsoft to respond by 16 March 2022. On 14 March 2022 Microsoft confirmed to the DPC it had removed the personal data of the Complainant, including the copy of the identity documents, from its systems. Microsoft noted however some details were retained, primarily the name of the Complainant, to ensure it had records of the delisting requests submitted to Microsoft.
4
An Coimisiún um Chosaint Sonraí
Data Protection Commission
14. The DPC informed the Complainant on 29 March 2022 via the Bavarian SA of Microsoft's deletion of all of his personal data including the identity documents. The DPC further noted the information provided by Microsoft regarding the retention of certain details, such as the Complainant's name, to ensure it had records of delisting requests submitted. The DPC's correspondence stated that, if the Complainant believed the information provided facilitated the resolution of his Complaint about Microsoft, that pursuant to section 109(3) of the Act, the DPC would deem the Complaint withdrawn and close the file on the matter. It requested that, should the Complainant remain dissatisfied, that he set out the reasons for this within two months of the date of the letter, so that the DPC could take further action.
15. On 12 April 2022 the DPC received the Complainant's rejection of amicable resolution of 11 April 2022 from the Bavarian SA, citing his dissatisfaction with the handling of his erasure request by Microsoft, notably the length of time it took for Microsoft to action his erasure request. The Complainant also raised a concern about the possible disclosure of his personal data to third parties, and about alleged criminal activity involving his website for a period of what he said was almost one year before Microsoft actioned his erasure request.
16. The DPC notified Microsoft of the Complainant's rejection of amicable resolution on 14 June 2022. The DPC requested Microsoft to respond to queries by 28 June 2022. The DPC asked Microsoft to outline the lawful basis Microsoft relied upon to retain the Complainant's name, as well as to respond to the concerns outlined by the Complainant in his response rejecting amicable resolution.
17. On 28 June 2022 Microsoft responded to the DPC and outlined that it retained a record of the Complainant's name to delist URLs associated with the Complainant's name. Microsoft confirmed that it had complied with the Complainant's erasure request by deleting additional documentation along with the Complainant's personal data that was not relevant to the ongoing management of his erasure requests. Microsoft informed the DPC that it had contacted the Complainant directly with the aforementioned information in the interest of amicably resolving the Complaint. The DPC forwarded Microsoft's responses to the Complainant's concerns to the Bavarian SA on 5 July 2022 for communication to the Complainant and requested a response within two months from the date of receipt of the letter.
18. On 13 September 2022, the Complainant, via the Bavarian SA, requested an extension of time to respond until 30 October 2022. The Complainant reverted to the DPC on 12 October 2022 via the Bavarian SA with his further rejection of amicable resolution, citing the length of time it took Microsoft to action his erasure request, as well as the initial response by Microsoft to the erasure request. The DPC forwarded the Complainant's response to Microsoft on 3 February 2023. The DPC requested that Microsoft explain what it meant in reference to the term "primarily" in Microsoft's correspondence of 14 March 2022 regarding the purposes for which it retained some personal data, and to outline the personal data retained in relation to the Complainant in addition to his name. The DPC requested Microsoft to respond by 17 February 2023. On 16 February 2023 Microsoft responded to the DPC's queries. It informed the DPC the information retained in addition to the Complainant's name was the details of the requests, including the name, contact
5
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
details, the URLs requested to be delisted, any other details relevant to the request and Microsoft's decision on each request.
19. On 5 April 2023 the DPC wrote to Microsoft to inform it that, despite the DPC's efforts to date in its complaint-handling process, it had not proven possible to reach an amicable resolution to the Complaint, and that the case would now proceed to a draft decision.
20. On 5 May 2023 the DPC sent an update to the Complainant via the Bavarian SA noting that the DPC continued to investigate his Complaint and that he would be provided with periodic updates as the matter progressed.
21. On 9 May 2023 the Bavarian SA sent an update to the DPC informing it that the Complainant could no longer be contacted via the email address he provided to the Bavarian SA in November 2022. The Bavarian SA stated it had carried out a civil register check and this was unsuccessful. The Bavarian SA stated it could not contact nor locate the Complainant.
22. On 27 June 2023, the DPC received a letter dated 21 June 2023 from the Bavarian SA, in which it further communicated to the DPC the impossibility of communicating with the Complainant due to having no postal address on record for him and no working e-mail address. The Bavarian SA further noted the proceedings should be brought to a conclusion as it could not be ruled out that the Complainant would inquire about the proceedings using a new address/e-mail address and that a decision could then be communicated to him.
23! The following issue remained unresolved at the conclusion of complaint handling:
- Whether Microsoft's handling of the Complainant's erasure requests was compliant with Articles 12 and 17 of the GDPR.
# Conduct of Inquiry
24. Acting in its capacity as LSA, the DPC commenced an Inquiry in relation to this matter by writing to Microsoft on 29 June 2023.
25. The DPC advised Microsoft that the Inquiry commenced by the Commencement Notice would seek to examine and address whether Microsoft had complied with its obligations under the GDPR and the Act, in particular under Articles 12 and 17 of the GDPR in respect of the relevant processing operations which are the subject matter of the Complaint.
26. In order to progress the matter, the DPC posed specific queries regarding the erasure requests and the manner in which they were handled by Microsoft.
27! The DPC also sought to inform the Complainant, via a letter sent to the Bavarian SA (for transfer to the Complainant) on 29 June 2023, that an Inquiry had commenced in relation to his Complaint and posed a series of queries in relation to the Complaint. The DPC requested the Complainant to
6
An Coimisiún um Chosaint Sonraí
Data Protection Commission
provide a copy of all communications received from and sent to Microsoft in relation to the Complaint, as well as the date the Complainant was informed by Microsoft that it had taken action on the Complainant's erasure request, including the de-listing of the URLs the Complainant had included in his erasure request.
28. The Bavarian SA informed the DPC on 4 July 2023, following receipt of the Commencement Notice intended for the Complainant: "Initially, he had informed us at the end of 2022 that he would no longer be reachable at the previous postal address and that he would like letters to be delivered by e-mail in the future. As we have now discovered, the e-mail address of the complainant is also no longer functional and delivery by e-mail can also no longer take place." It added that it unfortunately saw "no possibility" of sending the Complainant the DPC's correspondence of 29 June 2023. The DPC was therefore unable to clarify certain details pertaining to the Complainant's account of these matters.
29. On 21 July 2023 Microsoft responded to the queries raised by the DPC in its Commencement Notice. In its response Microsoft provided a comprehensive chronology of events, as set out below.
Microsoft's chronology of events is as follows:
"22 Mar-2021 – Right to be forgotten (RtBF) form submitted by the data subject requesting removal of four URLs.
27 Mar-2021 – Microsoft replied to the data subject confirming acceptance of removal of two URLs and rejecting removal of two URLs.
09-Oct-2021 – RtBF form submitted by the data subject requesting removal of three URLs.
17-Oct-2021 – Microsoft replied to the data subject rejecting the request for the three URLs.
03-Mar-2022 – Data subject contacted Microsoft's Privacy Response Centre (PRC) making an access request.
03-Mar-2022 – Microsoft's PRC replied to data subject with details on how they could authenticate the ownership of the data to receive a copy of the requested data.
04-Mar-2022 – Data subject informed the PRC that their request related to an old phone number, and they wanted to know how they could receive a copy of the data.
04-Mar-2022 – Microsoft's PRC confirmed that once the data subject authenticates ownership of data, the search for data would initiate. Microsoft's PRC also informed the data subject that Microsoft cannot provide information tied to a phone number for which the data subject cannot authenticate ownership.
07-Mar-2022 – Data subject informed Microsoft that their request related to old phone number and emails, and they could authenticate ownership. Additionally, the data subject mentioned data that was not removed from Microsoft's search engine (Bing), and repeated their access request, so they could confirm what they would likely want deleted.
09-Mar-2022 – Microsoft's PRC reiterated that we require authentication of ownership to provide data related to a data subject. Additionally, our agent also provided information on how the data subject could exercise their right for erasure related to information presented by Bing.
7
An Coimisiún um Chosaint Sonraí
Data Protection Commission
10-Mar-2022 – Data subject informed Microsoft they had uploaded valid identification documentation and that Microsoft didn’t confirm deletion of this data.
10-Mar-2022 Microsoft’s PRC requested the support ticket numbers for them to investigate the data subject’s complaint.
10-Mar-2022 – The data subject provided one support ticket number for investigation.
14-Mar-2022 – Microsoft’s PRC confirmed receipt of the support ticket number.
15-Mar-2022 – Microsoft’s PRC informed the data subject of the resolution of the data subject’s support ticket confirming two URLs were accepted for removal and two URLs were rejected for removal.
15-Mar-2022 – Data subject requested confirmation that the data deletion request previously submitted had been actioned.
25-Mar-2022 – Microsoft’s PRC confirmed that from the four URLs the data subject submitted for removal, two were accepted and two were rejected.
26-Mar-2022 – Data subject claimed there had been a misunderstanding of their request and they are inquiring about the data they provided for the RtBF request.
30-Mar-2022 – Microsoft’s PRC requested additional support ticket numbers to further investigate the data subject’s complaint.
31-Mar-2022 – Data subject provided additional support ticket number.
05-Apr-2022 – Microsoft’s PRC provided a copy of correspondence previously sent to the data subject confirming that in this second instance, three URLs were accepted for blocking and one URL was rejected.”
30. The DPC notes that the timelines submitted by the Complainant and Microsoft differ slightly as regards the dates some communications took place between Microsoft and the Complainant. However both timelines support the fact that erasure requests were made on 22 March 2021 and in or around the 9 October 2021 and it is those two erasure requests that the DPC is considering for the purposes of the findings in this Decision.
31. In response to the DPC’s query on the channel through which the Complainant’s erasure requests were received, Microsoft informed the DPC it had received the erasure requests from the Complainant initially via the Right to be Forgotten (RtBF) form, and subsequently through the Microsoft DPO’s email address when the DPC contacted Microsoft on 12 November 2021. Microsoft noted the Complainant further communicated with the Microsoft Privacy Response Channel in relation to what appeared to be an access request, but which the Complainant later clarified as an RtBF request.
32. As regards the DPC’s query on Microsoft’s compliance with Articles 12(3) and 12(4), in responding to the Complainant’s erasure requests pursuant to Article 17 of the GDPR, Microsoft stated it believed it had complied with these Articles. Microsoft stated its teams had communicated, without undue delay, with the Complainant and, where Microsoft required further information to assist with the Complainant’s request, Microsoft’s support agents communicated promptly with the data subject to request clarifications of the Complainant’s request. Microsoft stated it had reviewed all correspondence with the Complainant available in its systems but could not locate any correspondence with dates 26 March 2021 and 17 October 2021, (as stated by the DPC in its
8
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
understanding of the timeline based on the information provided to the DPC by the Complainant)
and was therefore unable to comment.
33. Following a request from the DPC, Microsoft clarified on 8 August 2023 that it specifically could
not locate any correspondence from the data subject to Microsoft with dates 26 March 2021 and
17 October 2021. It confirmed based on additional correspondence provided to it by the DPC that
the 26 March 2021 correspondence regarding case SRX[redacted] was no longer available on its
systems, so it could not comment on this matter. It also confirmed it could not locate the
correspondence from the data subject to Microsoft on 17 October 2021 and could not comment
on this matter. Microsoft said that, upon review, it identified that in its earlier response to the
DPC, correspondence that was sent from Microsoft to the data subject on 26 March 2021,
regarding case 5-0000[redacted], was incorrectly dated as 27 March 2021. The DPC does not
consider that this error in the date has any material bearing on the factual matters.
34. In response to the DPC's query regarding a delay, if any, in complying with the Complainant's
erasure request(s) within one month of receipt of the request(s), Microsoft stated that when the
Complainant submitted a request via the general privacy forum, the agents had difficulty
ascertaining what the Complaint was related to, based on the details provided, which made
triaging the request challenging. Microsoft further stated that the communication between the
privacy agents and the Complainant was ongoing from 3 March 2022 to 5 April 2022, at which
point the customer ceased any further communications. Microsoft stated there were no delays in
complying with the Complainant's erasure request(s). Microsoft noted all URLs submitted for
blocking under the RtBF form were actioned within the required timeframe. All documentation
submitted by the Complainant with his RtBF requests, including ID verification, was automatically
deleted as per Microsoft's retention policy 60 days after case resolution. Microsoft noted the
timeframe in which the requests and ID verification was deleted aligned with the requirements of
Article 5(1)(e) of the GDPR, i.e. the storage limitation principle.
35. In response to the DPC's query as to the date Microsoft had completed the erasure of the
Complainant's personal data, Microsoft outlined a timeline of the dates on which erasure took
place. According to the timeline provided by Microsoft, erasure commenced on 27 March 2021
and concluded on 5 April 2022. Microsoft noted it automatically deletes all documentation
associated with a RtBF request, including ID verification, within 60 days of case resolution and that
therefore, the copies of the ID provided by the Complainant in respect of certain requests had
been respectively deleted on 31 May 2021 and 8 December 2021.
36. As regards the DPC's query on the categories of the Complainant's personal data deleted by
Microsoft, Microsoft noted the categories of personal data deleted from Microsoft's systems as a
result of the Complainant's erasure request were all documentation, including ID verification, that
was included at the time of each RtBF submission as well as any approved URLs from Bing search
results in the EU for the queries specified.
37. Microsoft, as part of its response to the DPC query on the modalities available to data subjects to
exercise their rights under Article 17 of the GDPR (including details of portals, hyperlinks, phone
numbers, web forms and other means by which the individuals may contact Microsoft with such
9
An Coimisiún um Chosaint Sonraí
Data Protection Commission
requests), provided the DPC with the requested information. Microsoft informed the DPC that Microsoft users can make GDPR-related requests when [they] are logged onto their account via the Privacy Dashboard, accessible via the URL:
https://account.microsoft.com/account/privacy?ru=https%3A%2F%2Faccount.microsoft.com%2Fprivacy&destrt=privacy-dashboard.
In addition Microsoft has a dedicated portal to assist data subjects to exercise their GDPR rights which include erasure requests under Article 17, at the following address: https://www.microsoft.com/en-ie/concern/privacy.
Microsoft stated that EU/EEA residents can also submit a RtBF request using the Request Form to Block Search results in Europe, found at this address:
https://www.bing.com/webmaster/tools/eu-privacy-request
Additionally Microsoft stated that data subjects can report concerns through the form Report a Concern to Bing Europe:
https://www.microsoft.com/en-us/concern/bing
Microsoft stated that the Microsoft Privacy Statement provides information on how to contact Microsoft in the section "How to contact us" and that data subjects can locate the Microsoft European Data Protection Officer under GDPR on the Microsoft Learn webpage within the Microsoft Compliance section.
Microsoft informed the DPC that where data subjects contact it via postal letters, calls to non-dedicated phone numbers and emails, as well as via official Microsoft social medias, Microsoft employees managing these channels have received training and provide the necessary information to direct the data subject's requests to the Microsoft privacy support team (Microsoft PRC). Microsoft stated that if a request contains sufficient details to be identified as specifically related to the right to be forgotten, employees will share the request with the Bing Content Moderation Operations team.
38. In response to the DPC's query, Microsoft provided the details of its procedures for identifying and for escalating subject requests under the GDPR to the correct channels including where such requests may be submitted by post or through customer service or other non-DPO channels. Microsoft stated it provides annual training to employees on privacy compliance requirements, including the GDPR. Additional training is provided to customer support agents to empower them to identify and properly escalate privacy requests they may receive on the channels they support. Microsoft noted it makes available to employees guidance material on how to handle customer inquiries relating to personal data subject rights and other privacy protection related questions. Microsoft informed this Inquiry that this material is updated as needed. Further, Microsoft noted it provided specific refresher trainings and updated guidance material to provide support to agents whenever needed so as to improve identification of privacy protection related questions and to ensure their proper handling.
10
An Coimisiún um Chosaint Sonraí
Data Protection Commission
# Notification of Preliminary Draft Decision to the Controller
39. The DPC provided Microsoft a copy of the Preliminary Draft Decision on 23 August 2023 and requested that Microsoft provide submissions in relation to the content by close of business on 15 September 2023.
40. In its response of 15 September Microsoft informed the DPC that as regards its preliminary findings in relation to Microsoft's infringement of Article 12(4) in failing to inform the Complainant of his right to a judicial remedy, that it had begun to implement the language requested in the Preliminary Draft Decision.
41. Microsoft further provided on 15 September 2023, in relation to the preliminary finding as regards Microsoft's failure to take action on the erasure request of 9 October 2021, the following information:
"The URLs submitted for removal on October 9, 2021, were found to be ineligible for removal because we determined that there was a significant public interest in accessing this information as it related to the data subject's working life. The data subject was notified of our decision and the case was closed without undue delay by October 17, 2021. The data subject resubmitted the URLs on November 19, 2021, and the team reassessed the content and determined that it was eligible for removal and accepted blockage at that time and the data subject was notified of our decision and the case was closed without undue delay by November 26, 2021. The data subject resubmitted the same URLs for a third time on March 1, 2022, and we accepted blockage again and the data subject was notified of our decision and the case was closed without undue delay on March 6, 2022. See Appendix 1. The one-month deadline to comply reset each time that the URLs were resubmitted for evaluation. The data subject also submitted a request via Microsoft's general privacy form and, due to the lack of clarity in the details provided, there was difficulty understanding the substance of the request leading to an extended response time."
42. The DPC put further queries to Microsoft on 21 September 2023. The DPC requested that Microsoft confirm the date on which the URLs submitted as part of the Complainant's erasure request of 9 October 2021 were erased and that it identify the URLs that were erased. The DPC also asked Microsoft to confirm whether the same three URLs were available in internet search results as of 1 March 2022, when they were submitted for a third time by the Complainant. The DPC requested that Microsoft respond to these queries by 29 September 2023.
43. On 29 September 2023, Microsoft responded to the DPC's further queries. Microsoft stated the URLs submitted for removal on 9 October 2021, were originally rejected for blocking because the URLs related to the data subject's work life. The URLs were not approved for blocking until Microsoft submitted an internal RtBF request on behalf of the data subject in response to the DPC's letter of 12 November 2021. The URLs were approved and submitted for blocking of the data subject's name no later than 26 November 2021. The URLs that were blocked for searches of the data subject's name are as follows:
https.[redacted1].pdf
11
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
https.[redacted2].pdf
and
https.[redacted3].pdf
44. On 5 October 2023 the DPC requested that Microsoft confirm the exact date on which the URLs were blocked, i.e. the date on which they were no longer available in an internet search result. On 6 October 2023 Microsoft responded and informed the DPC that it was “unable to confirm the exact date on which the URLs would no longer have been presenting in search results, given the way our technology operates. Our estimates are based on what we have seen with similar delisting requests. The delisting requests were indeed processed twice, once in October, and once in March. This was out of an abundance of caution on Microsoft’s part.”
# Notification of Preliminary Draft Decision to the Complainant
45. On 12 September 2023 the DPC attempted to provide the Complainant, via the Bavarian SA, with a copy of the Preliminary Draft Decision. In its correspondence, the DPC also invited the Complainant to provide their submissions on the Preliminary Draft Decision and provided a deadline of two weeks from the date of receipt of the Preliminary Draft Decision. The Bavarian SA contacted the DPC on 13 September 2023 and informed the DPC that, unfortunately, it could not issue the update [the Preliminary Draft Decision] to the Complainant. It stated that a civil register check carried out in relation to the Complainant in May had been unsuccessful. As a result, it could not contact the Complainant by post and the email address he had provided to it was still invalid.
# Relevant and Reasoned Objections and Comments from “supervisory authorities concerned”
46. Having transmitted the Preliminary Draft Decision on 13 October 2023 to the “supervisory authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC did not subsequently receive any relevant or reasoned objections or comments under Article 60(4).
# Applicable Law
47. For the purposes of its examination and assessment of this Complaint, the DPC has considered the following Articles of the GDPR:
Article 12
Article 17
# Facts Established, Analysis and Findings of Inquiry
48. This section analyses the facts established in the Inquiry and whether Microsoft’s handling of the Complainant’s erasure requests was compliant with Articles 12 and 17 of the GDPR.
The relevant legal provisions are as follows:
12
An Coimisiún um Chosaint Sonraí
Data Protection Commission
According to Article 12(3) of the GDPR, the controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.
Article 12(4) of the GDPR provides that, if the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
According to Article 17 of the GDPR, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay.
49. The DPC understands the Complainant submitted at least two erasure requests and, as part of those requests, stated "Please delete all pages, data, storage within 48 hours and files submitted by me in accordance with the GDPR. Onward transfer to third parties is not allowed. I would be grateful if you could confirm this."
50. The DPC is satisfied from the submissions provided that two distinct erasure requests were submitted by the Complainant, one on 22 March 2021 ("the March Request"), and a second request on 9 October 2021 ("the October Request").
# The March Request:
51. On 22 March 2021 the Complainant requested the removal of four URLs from the Bing search engine (outlined below in Table 1).
Table 1: 22 March 2021 erasure request
| URLs | Address |
| --- | --- |
| URL 1 | https://www.[redacted].html |
| URL 2 | https://www.[redacted].er |
| URL 3 | https://.www[redacted].RE |
| URL 4 | https://www.[redacted].de |
52. As regards the March Request, the DPC understands that Microsoft accepted the deletion of two of the four URLs submitted for deletion (i.e. URL 1 and URL 2 above). As regards URL 3 and URL 4, Microsoft specified the reason for rejection of the deletion of these URLs was due to "public interest in accessing this information outweighs [the Complainant's] interest in privacy." Microsoft informed the Complainant of its decision on 27 March 2021, within five days of the request.
53. As can be understood from the submissions, Microsoft commenced erasure on 22 March 2021 and completed erasure of URL 1 and URL 2 of the March Request on 27 March 2021 (as outlined in Table 2 below). Microsoft provided the Complainant with the specific reason for rejection of erasure of URL 3 and URL 4 on 5 April 2022. It said the initial reason for rejection of URL 4 was due to the fact it was a dead link. Microsoft told the Complainant that the URL had since been blocked [from search results]. The reason for rejection of URL 3 was due to the fact the URL led to a search engine results page and was not a specific URL [i.e. a URL relating to the Complainant].
13
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Table 2: Timeline of erasure for March Request
| Date of erasure request | Erasure Commenced | Erasure Completed | URLs |
| --- | --- | --- | --- |
| 22 March 2021 | 27-Mar-2021 | 27-Mar-2021 | https://www.[redacted].html |
| 22 March 2021 | 27-Mar-2021 | 27-Mar-2021 | https://www.[redacted].er |
| 22 March 2021 | Rejected | Rejected | https://.www[redacted].RE |
| 22 March 2021 | Initially rejected 27-Mar-2021 | 05-Apr-2022 | https://www.[redacted].de |
54. Due to the impossibility of clarifying the Complainant's submissions with him, as explained above in paragraph 28, and the fact the DPC has not had an opportunity to receive any further submissions from the Complainant, the DPC has not seen the original wording of the March Request. It is not clear, therefore, whether the Complainant's request of 22 March 2021 made clear that the domain name in question, a publicly available website, was owned by the Complainant. It is also not clear whether the Complainant requested erasure of all URLs associated with that domain name appearing in Bing search results. While the Complainant's intention may, as early as 22 March 2021, have been to seek erasure of all pages related to his own website domain, the DPC cannot confirm this with him and has no evidence in writing to determine what his intentions were. The DPC does not therefore propose to consider further whether Microsoft's refusal to de-list the domain name as part of the March Request due to public interest in accessing it was justified. The DPC understands in any case that after it engaged with Microsoft, it delisted the domain name specified in URL 4 on 5 April 2022, as outlined below in Table 3 of this Decision.
55. The DPC will also not further consider URL 3 of the March Request as Microsoft's explanation made clear that this was merely a Bing search page which returns results based on the input of a search term.
56. According to Microsoft, it deleted all URLs submitted for erasure within the required timeframe, as per its submissions in response to the DPC's queries. The DPC accepts that the March Request was carried out without undue delay, and that any reason for rejection was explained to the Complainant.
57. As per the timeline provided by Microsoft, outlined at paragraph 29, Microsoft responded to the Complainant's first erasure request, the March request, within 5 days of receipt. Throughout its communications with the Complainant, Microsoft informed the Complainant of the steps taken, or not taken, in response to his requests. Microsoft regularly provided the Complainant with information on action taken, or in certain instances any action not taken, on his erasure request.
58. Microsoft provided the Complainant with information on the possibility of lodging a complaint with a supervisory authority when it rejected the request for erasure of two of the URLs in the March Request. However, from the information provided to the DPC, Microsoft did not inform the Complainant of his right to a judicial remedy at any stage of its communications with the Complainant in its partial rejection on 27 March 2021 of his 22 March 2021 erasure request.
14
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
59. FINDING 1: On the basis of the above, the DPC finds that Microsoft infringed Article 12(4) of the GDPR on 27 March 2021 as it failed to provide the Complainant with information that he had a right to seek a judicial remedy, in circumstances where it was refusing, or partly refusing, to take action on the erasure request made by the Complainant on 22 March 2021.
## The October Request
60. The DPC is satisfied from the submissions provided by Microsoft to this Inquiry that there was also a specific request for erasure submitted by the Complainant on 9 October 2021 in relation to the three URLs listed below in Table 3.
Table 3: 9 October 2021 erasure request
| URLs | Address |
| --- | --- |
| URL 1 | https://[redacted1].pdf |
| URL 2 | https://[redacted2].pdf |
| URL 3 | https://[redacted3].pdf |
As regards the Complainant's October Request, the DPC understands Microsoft rejected the request to erase the three URLs specified above in Table 3 on 17 October 2021, informing the Complainant of its decision within eight days of his request. Microsoft stated it had "reviewed [the Complainant's] application and determined that there is a significant public interest in accessing this information as it relates to [the Complainant's] working life. We have therefore decided not to take any action for these URLs...".
However, it later transpired that this decision by Microsoft not to take any action was an error by its intake team. The DPC contacted Microsoft on 12 November 2021 regarding the commencement of the complaint-handling procedure. The DPC made specific reference to the URLs of the October request and requested Microsoft to provide the Complainant with further details regarding the reasons why the delisting of the pertinent URLs had been refused by 29 November 2021. On 29 November 2021, Microsoft responded to the DPC and informed the DPC that its intake team had rejected the [October] request when it should have accepted it and had the content delisted. Microsoft informed the DPC it was working to delist the content and that it should be taken down in the coming days.
61. However, as can be seen below in Table 4 Microsoft's Timeline of erasure for the October Request, in respect of the October request, and based on the DPC's follow-up queries to Microsoft, the DPC understands that the erasure of those URLs may not have been fully completed until 6 March 2022. From the information provided by Microsoft, the DPC therefore understands that erasure of the October request URLs began on 26 November 2021 (49 days after receipt of the erasure request) and that the de-listing process was not fully completed until 6 March 2022 (almost five months after receipt of the erasure request). This assessment is based on the information provided by Microsoft that the Complainant resubmitted a request for de-listing to Microsoft on 1 March 2022¹.
¹ Paragraph 41
15
An Coimisiún um Chosaint Sonraí
Data Protection Commission
**Table 4: Timeline of erasure for October Request**
| Date of erasure request | Request Status | Erasure Commenced | Erasure Completed | URLs |
| --- | --- | --- | --- | --- |
| 9 October 2021 | Initial rejection - 17 October 2021 | 26 November 2021 | no later than 6 March 2022 | https[redacted1].pdf |
| 9 October 2021 | Initial rejection - 17 October 2021 | 26 November 2021 | no later than 6 March 2022 | https[redacted2].pdf |
| 9 October 2021 | Initial rejection - 17 October 2021 | 26 November 2021 | no later than 6 March 2022 | https[redacted3].pdf |
62. The DPC notes a further URL related to a page on the www.[redacted].de domain, was submitted for erasure on 1 February 2022 following a request to Microsoft by the DPC and erasure was completed by 6 March 2022.
63. According to Article 12(4), the controller, if it does not take action on the request of the data subject, shall inform the data subject without undue delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
64. Microsoft provided the Complainant with information on the possibility of lodging a complaint with a supervisory authority on 17 October 2021 when it rejected his 9 October 2021 request for erasure of three particular URLs. However, from the information provided to the DPC, Microsoft did not inform the Complainant of his right to a judicial remedy on that date.
65. Following receipt of Microsoft's submissions on the Preliminary Draft Decision, and its disagreement with the proposed finding of infringement of Article 17, the DPC twice sought clarification on the issue of when exactly those three URLs would no longer have been available in a search result. Microsoft was unable to clarify this. However, as Microsoft had in any case accepted that the three URLs should originally have been accepted for de-listing when the Complainant made his request on 9 October 2021, the DPC finds that Microsoft infringed Article 17 of the GDPR as it did not act on the Complainant's request "without undue delay". The de-listing of the three URLs in the October Request did not commence until 26 November 2021, after the DPC had notified Microsoft of the Complaint, at which time Microsoft established that the URLs should have originally been accepted for delisting when the Complainant made his request on 9 October 2021. On this basis the DPC finds that Microsoft did not act on the Complainant's 9 October 2021 request without undue delay, as required by Article 17.
16
An Coimisiún um Chosaint Sonraí
Data Protection
Commission.
66. FINDING 2: On the basis of the above, the DPC finds that Microsoft infringed Article 12(4) of the GDPR on 17 October 2021 as it failed to provide the Complainant with information that he had a right to seek a judicial remedy, in circumstances where it was refusing, or partly refusing, to take action on the erasure request made by the Complainant on 9 October 2021.
67. FINDING 3: On the basis of the above, the DPC finds that Microsoft infringed Article 17 of the GDPR as it failed to correctly action the Complainant's 9 October 2021 erasure request and did not commence the de-listing process until 26 November 2021, 49 days after receipt of the request.
68. As Microsoft accepted that the URLs in this request should have been identified in the first instance as eligible for delisting, and as it was unable to clarify with certainty when the URLs were no longer available in search results, Microsoft infringed Article 17 as it failed to erase the Complainant's personal data, i.e. the three URLs listed in the 9 October 2021 erasure request, without undue delay.
# Summary of Decision on infringements of the GDPR
69. Following the investigation of the Complaint against Microsoft, the DPC finds that Microsoft infringed the General Data Protection Regulation as follows:
- Article 12(4) of the GDPR
The DPC finds that Microsoft infringed Article 12(4) of the GDPR on 27 March 2021 by failing to inform the Complainant of the possibility of seeking a judicial remedy when it responded to him outlining the reasons for not taking action, in part, on his erasure request.
- Article 12(4) of the GDPR
The DPC finds that Microsoft infringed Article 12(4) of the GDPR on 17 October 2021 by failing to inform the Complainant of the possibility of seeking a judicial remedy when it responded to him outlining the reasons for not taking action on his erasure request.
- Article 17 of the GDPR
The DPC finds that Microsoft infringed Article 17 of the GDPR by failing to erase personal data that were the subject of the Complainant's erasure request of 9 October 2021 without undue delay.
# Remedial measures undertaken by Microsoft
70. The DPC notes Microsoft's statement provided in its submission as regards the training provided to agents, including annual training on privacy compliance, guidance material to handle customer inquiries and refresher training to improve identification of privacy protection-related questions and ensure proper handling of subject rights requests under the GDPR.
17
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
71. The DPC further notes Microsoft's commencement of modification to the language used in response to data subjects' rights requests received to ensure the data subject is aware of their rights. Microsoft has stated it is in the early stages of implementing the language the DPC had noted was lacking in its preliminary findings in the Preliminary Draft Decision.
# Judicial Remedies
72. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against imposition upon it of an administrative fine by the DPC.
# Exercise of Corrective Powers by the DPC
73. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the Commission's power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the criteria set out in Article 83(2) (a) - (k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective, proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)$^{2}$. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GDPR as set out above.
74. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Microsoft, pursuant to Article 58(2)(b) of the GDPR.
75. In light of the infringements of Articles 12(4) and 17 in the case of this data subject, I find it necessary that the controller bring its processing into compliance to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances. Accordingly, the DPC proposes to order Microsoft to revise its internal policies and procedures as regards the information to be provided to data subjects pursuant to Article 12, to ensure that, where it informs data subjects on foot of requests made under Articles 15 to 22 of the GDPR that it has decided not to take action on the request, that data subjects are informed in all cases of their right to seek a judicial remedy. This order is made pursuant to the DPC's corrective powers under Article 58(2)(d) of the GDPR. Microsoft is requested to provide details of its revised internal policies and procedures to the DPC by 7 February 2024.
² Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679', at page 11.
18
[LOGO]
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
Signed: Tony Delaney
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
19