In the matter of the General Data Protection Regulation
DPC Complaint Reference:
In the matter of a complaint, lodged by with the Data Protection Commission
pursuant to Article 77 of the General Data Protection Regulation, concerning Microsoft Ireland
Operations Limited.
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to
Section 109(3) of the Data Protection Act, 2018
Further to the requirements of EDPB Guidelines 06/2022 on the practical implementation of
amicable settlements Version 2.0 (adopted on 12 May 2022)
RECORD OF AMICABLE RESOLUTION FOR THE
PURPOSE OF EDPB GUIDELINES 06/2022 ON THE
PRACTICAL IMPLEMENTATION OF AMICABLE
SETTLEMENTS VERSION 2.0, ADOPTED 12 MAY 2022
Dated the 14th day of April 2023
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Background
1. (“the Data Subject”) lodged a complaint pursuant to Article 77 GDPR with the
Data Protection Commission (“the DPC”) concerning Microsoft Ireland Operations Limited
(“the Respondent”).
2. The DPC was deemed to be the competent authority for the purpose of Article 56(1) GDPR.
The Complaint
3. The details of the complaint were as follows:
a. The Data Subject contacted the Respondent and submitted a delisting request for the
removal of several URLs pursuant to Article 17 GDPR.
b. The Data Subject was not satisfied with the Respondent’s response to their delisting
request, as the Respondent had refused to delist a number of requested URLs. The
URLs which were the subject matter of the Data Subject’s complaint related to a
criminal conviction the Data Subject had received, but which was now spent.
Action taken by the DPC
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 (“the 2018 Act”), is
required, as a preliminary matter, to assess the likelihood of the parties to the complaint
reaching, within a reasonable time, an amicable resolution of the subject-matter of the
complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable
resolution being concluded between the parties, it is empowered, by Section 109(2) of the
2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an
amicable resolution.
5. Following a preliminary examination of the material referred to it by the Data Subject, the DPC
considered that there was a reasonable likelihood of the parties concerned reaching, within a
reasonable time, an amicable resolution of the subject matter of the complaint. The DPC’s
experience is that complaints of this nature are particularly suitable for amicable resolution in
circumstances where there is an obvious solution to the dispute, if the respondent is willing
to engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an
individual consumer and a service provider); and
b. The nature of the complaint (in this case, an unsuccessful attempt by the Data Subject
to exercise their data subject rights).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section
109(4) of the 2018 Act, the DPC also had regard to EDPB Guidelines 06/2022 on the practical
2
implementation of amicable settlements Version 2.0, adopted on 12 May 2022 (“Document
06/2022”), and considered that:
a. the possible conclusion of the complaint by way of amicable resolution would not
hamper the ability of the supervisory authorities to maintain the high level of
protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject,
whose rights under the GDPR would be vindicated swiftly, as well as for the controller,
who would be provided the opportunity to bring its behaviour into compliance with
the GDPR.
Amicable Resolution
7. The DPC engaged with both the Data Subject, via their legal representative, and Respondent
in relation to the subject-matter of the complaint. On 1 April 2021, the DPC outlined the Data
Subject’s complaint to the Respondent. On 3 May 2021, the Respondent responded to the
DPC. The Respondent informed the DPC that it had blocked six of the thirteen submitted URLs
under its junk URL policy. With respect to the remaining URLs, the Respondent stated that it
believed it had actioned the Data Subject’s delisting request appropriately.
8. On 24 August 2021, the DPC wrote to the Respondent, advising it to ensure that it takes into
consideration the fact that the Data Subject’s conviction was spent when applying the
balancing test, as the DPC considered this an important factor with respect to ensuring the
Respondent has applied the balancing test in this case appropriately.
9. On 8 September 2021, the Respondent responded to the DPC, confirming that, following
another assessment, it would delist the requested URLs. However, on 8 October 2021, the
DPC informed the Respondent that a search conducted by the DPC of the complained of URLs
had shown that one of the URLs previously confirmed for delisting was still being returned.
The DPC requested that the Respondent action the Data Subject’s delisting request in full.
10. On 21 December 2021, the Data Subject’s legal representative informed the DPC that a
number of URLs were still appearing following a search of the Data Subject’s name on the
Respondent’s search engine. Upon investigation of the URLs which the Data Subject’s legal
representative had stated were returning, the DPC noted that the search terms being used
were not based on the Data Subject’s name. The DPC noted to the Data Subject’s legal
representative that delisting requests for search terms not based on an individual’s name are
not within the scope of the right to be forgotten.
11. On 4 February 2022, the Respondent responded to the DPC. The Respondent explained that
most of the requested URLs for delisting consisted of Search Engine Results Page (SERP) URLs,
which it could not delist, and that it had requested the Data Subject provide it with the specific
URL of the image itself. Notwithstanding this, the Respondent stated that it had attempted to
locate the specific URL of the image itself, and provided the DPC with two possible URLs. The
Respondent requested confirmation from the DPC whether these were the URLs that the Data
3
Subject wished to have delisted. The Respondent stated that, upon receipt of this
confirmation, it would proceed with delisting the URLs.
12. The DPC wrote to the Data Subject’s legal representative on 11 February 2022, and requested
confirmation that the URLs identified by the Respondent were indeed the URLs the Data
Subject wished to have delisted. On 14 February 2022, the Data Subject’s legal representative
confirmed same. The DPC subsequently wrote to the Respondent on 24 February 2022,
confirming that the URLs it had identified were indeed the correct URLs to be delisted.
13. On 10 March 2022, the Respondent responded to the DPC, confirming that it had taken the
appropriate actions to delist the image URLs, and that the URLs no longer return against
searches of the Data Subject’s name.
14. On 11 May 2022, the Data Subject’s legal representative requested that the URLs which were
the subject matter of the Data Subject’s complaint should be delisted against a number of
different search terms other than those based on the Data Subject’s name. On 13 June 2022,
the DPC directed the Data Subject’s legal representative to the relevant European Court of
Justice case law and European Data Protection Board guidelines in relation to the application
of the right to be forgotten. The DPC also highlighted that their correspondence of 11 May
2022 did not indicate any disagreement with the Respondent’s assertion that all eligible
complained-of URLs had now been delisted. The DPC outlined that, absent the Data Subject
raising any further concerns in relation to the originally complained-of URLs, the DPC
considered that the Data Subject’s original complaint against the Respondent had been
successfully resolved.
15. On 29 September 2022, the Data Subject’s legal representative confirmed to the DPC that they
had been instructed to pursue any unresolved issues with their complaint outside of the remit
of the DPC, but that the Data Subject reserved their right to re-engage with the DPC in relation
to the issues which were the subject matter of the complaint, if required in the future.
16. On 18 October 2022, the DPC wrote to the Data Subject’s legal representative, noting that,
with all of the eligible complained-of URLs which were the subject matter of the complaint
now being delisted, the dispute between the Data Subject and Respondent appeared to have
been resolved, and that there were no outstanding data protection issues to be considered.
The DPC noted that absent any further data protection issues being raised by the Data Subject,
the DPC would move to conclude the Data Subject’s complaint. The DPC explained to the Data
Subject’s legal representatives that this would not prevent the Data Subject from raising
further data protection issues with the DPC in the future in the form of a new complaint. In
the circumstances, the DPC asked the Data Subject to notify it, within one month, if they were
not satisfied with the outcome, so that the DPC could take further action. The DPC did not
receive any further communication from the Data Subject or their legal representative and,
accordingly, the complaint has been deemed to have been amicably resolved.
4
17. In circumstances where the subject-matter of the complaint has been amicably resolved, in
full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been
withdrawn by the Data Subject.
Confirmation of Outcome
18. For the purpose of Document 06/2022, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties
concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
c. Having consulted with the supervisory authorities concerned on the information set
out above, as required by Document 06/2022 the DPC has now closed off its file in
this matter.
19. If dissatisfied with the outcome recorded herein, the parties have the right to an effective
remedy by way of an application for judicial review, by the Irish High Court, of the process
applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
_____________________________
Deputy Commissioner
Data Protection Commission
5