An Coimisign um
Chosaint Sonrat
Data Protection
Commission
opc ref: fii
DPC Complaint Ref: f |
Date: 15 November 2023
Complainant: | |
Data Controller: Microsoft Operations Ireland Limited
RE: a: Microsoft Operations Ireland Limited
DECISION
This document is a Decision of the Data Protection Commission (“DPC”) in relation to DPC Complaint
reference in hereinafter referred to as the (“Complaint”), submitted “by
(“Complainant”) against Microsoft Operations Ireland Limited (“Microsoft”) to the DPC in its capacity
as the lead supervisory authority (“LSA”).
{
This Decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data
Protection Act 2018 (“the Act”) and Article 60 of the General Data Protection Regulation (“GDPR”).
Communication of Draft Decision to “supervisory authorities concerned”
In accordance with Article 60(3) GDPR, the DPC was obliged to communicate the relevant information
and submit a draft decision, in relation to a complaint regarding cross border processing, to the
supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the matter to the
“supervisory authorities concerned”. As Microsoft offers services across the EU, and therefore the
processing is likely to substantially affect data subjects in every EU member state, the DPC in its role
as LSA identified that each supervisory authority is a supervisory authority concerned,as defined in
Article 4(22) GDPR. On this basis, the Draft Decision of the DPC in relation to this Complaint was
transmitted to each supervisory authority in the EU and EEA for their opinion.
Complaint Handling by the DPC — Timeline and Summary
1. The Complaint that is the subject of this Decision concerns alleged infringements of Articles 12
and 17 of the GDPR in relation to erasure requests submitted to the Controller.
2. On8 April 2021, the Complainant made a complaint to the Bavarian SA (Bavarian Lander Office
for Data Protection Supervision). The Complainant stated he had made an erasure request to
Microsoft regarding a website and other data he wished to be deleted from Microsoft’s search
engine, stating: “/ have, among other things, a website that is connected to (x. | wrote
to Microsoft to delete data from its search machine.” The Complainant stated he received links to
forms to fill out, that he had to give personal data and attach a copy of his ID card. The
Complainant informed the Bavarian SA that Microsoft refused to delete all the requested search
results due to public interest. He said he did not agree with this because it was “a matter of private
interest, copyright and the desire for erasure”. The Complainant noted he was then led to “a
An Coimisign um
Chosaint Sonrai
Data Protection
Commission
computer assistant who did not understand what | wrote”. This led the Complainant to write a
letter to Microsoft’s office in Munich with his erasure request. In his Complaint to the Bavarian
SA, the Complainant reiterated his erasure request, and stated “/ now want all my data to be
erased by this company (including from all search engines)” .
The DPC received the Complaint from the Bavarian SA on 28 July 2021.
Based on the correspondence provided to the DPC by the Bavarian SA on this date and in
subsequent engagement to clarify some matters, the DPC understands the chronology of events
up to this point to be as follows:
On at least one occasion prior to 26 March 2021, the Complainant made an erasure
request to Microsoft pursuant to Article 17 of the GDPR. The original request or requests
have not been made available to the DPC.
On 26 March 2021 Microsoft Customer Support responded to what appears to have been
a prior email from the Complainant. This email instructed him on the procedure to close
an account. Microsoft provided him with a link outlining instructions and stating: “The
owner of the Microsoft account is the only person able to manage the account, i.e. | cannot
and cannot [sic] close the account for you. Accounts are automatically closed after 2 years
of inactivity, but if you want to do so, please follow these instructions” .
Later on 26 March 2021, the Complainant submitted an erasure request to Microsoft for
the deletion of all pages, data and files in “the search engine” (i.e. the Bing search engine
operated by Microsoft). This request of 26 March 2021 appears to have been made by
email to a Microsoft Customer Support channel. This email stated that the request was
not related to an account, but was about “data protection in general”. |t added: “You have
received data from me, among other things, with regard to: Deletion of pages and files in
the search engine; Which | want to have deleted and confirmed.” While the Complainant
stated in this message that requested deletion of pages and files in the search engine was
his “4‘ email’, no documentation indicating earlier contact with Microsoft than 26 March
2021 was provided in support of the Complaint.
On 27 March 2021, Microsoft (via the ([email protected] address) emailed the
Complainant to inform him that it would remove two URLs from Bing search results
following a request from him. These were the following:
(i) Https://www.|[redacted]
(ii) https://www.xing.com/profile/[redacted]
Microsoft stated that in relation to two other URLs, it would take no action as it had
decided that the public interest “outweighs your interest in privacy”. The items
Microsoft stated it would not delete were a link to a Bing search result which returned
results based on the Complainant’s name, and search hits associated with the website
www.|redacted].de
On 10 May 2021 the Complainant appears to have submitted an update request to
Microsoft by email stating: “/ would once again ask you to delete all stored and collected
data from your systems irrevocably and completely....... This includes all data including files
sent for the following deletion request: Microsoft Bing.” The Complainant included a
reference number which he stated related to his previous erasure request.
An Coimisign um
Chosaint Sonrat
Data Protection
Commission
e On13 May 2021 Microsoft Customer Support appears to have responded and provided a
link to instructions to close a Microsoft account.
On 9 October 2021, the Complainant contacted the Bavarian SA in response to DPC queries issued
to the Complainant by the Bavarian SA on 23 September 2021. The Complainant noted his erasure
request had not been completed by Microsoft.
On 19 October 2021, the Bavarian SA wrote to the DPC providing additional clarification regarding
three URLs linked to the Complainant which he wanted Microsoft to de-list, following further
correspondence from him to that SA on 17 October 2021.
The correspondence included a copy of an email dated 17 October 2021 from Microsoft (from
GE @ microsoft.com) to the Complainant. This email stated: “We have reviewed your request
and determined that there is a significant public interest in accessing this information as it relates
to your work life. We have therefore decided to take no action on this URL(s):
https://[redacted1].pdf
https://[redacted2].pdf
https://[redacted3].pdf”
The Complainant’s email to the Bavarian SA of 17 October 2021, which was provided to the DPC,
stated that the links were “openly on the net” for a year despite his requests for deletion. He said
the search hits included his address, telephone number and account data. He stated that he had
received extortion letters and that these were with the police. The company he owned [i.e. the
company associated with the [redacted].de domain] “no longer exists”, he stated. The
Complainant also stated in relation to Microsoft’s refusal to remove the www.|[redacted].de URLs
from its search hits that the company “is not able or does not want to grasp that | am the
webmaster and creator’.
On 12 November 2021, the DPC commenced the process of complaint-handling. In its
commencement of complaint-handling notice to Microsoft, the DPC raised the issue cf the
Complainant’s erasure request. The DPC noted in its commencement notice to Microsoft the
Complainant wished the following URLs to be delisted from the search engine:
https://[redacted1].pdf
https://[redacted2].pdf
https://[redacted3].pdf
The commencement notice referred to the Complainant’s adherence to Microsoft’s request-for-
erasure’ procedure and his provision of personal data as part of that process, including the
uploading of a copy of his identity card. The DPC noted the Complainant requested the deletion
of all personal information provided in connection with his erasure request, including the copy of
his ID card that the Complainant provided to Microsoft as part of the erasure request. The notice
also referred to Microsoft’s response to the Complainant on 17 October 2021 where it stated the
10.
11.
12.
13.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
URLs could not be delisted due to a significant public interest in accessing that information as it
related to the Complainant’s work life.
The commencement notice requested that Microsoft take the following steps by 29 November
2021: (i) outline in further detail the reasons that the Complainant’s request for delisting of the
pertinent URLs had been refused and (ii) outline whether Microsoft had fulfilled the Complainant’s
erasure request in a manner it considered consistent with Article 17 of the GDPR, with supporting
evidence if this was the case.
On 29 Névember 2021 Microsoft responded to the DPC and stated: “We have re-reviewed [the
Complainant's] request and determined that our intake team rejected this case when it should
have been accepted and the content delisted. We are working to delist the content under the EU
Right to Be Forgotten now and it should be down in the coming days.”
On 1 February 2022 the DPC wrote to Microsoft and noted it had carried out a Bing search on the
Complainant’s name on that date with the following URL having appeared as a result:
https://www.|[redacted4].pdf
In its correspondence to Microsoft, the DPC said it recognised that this URL was not one of the
[redacted].de URLs which Microsoft had already agreed to delist. The DPC said it anticipated that,
in order for amicable resolution to be amenable to the data subject, this URL would also have to
be delisted. The DPC asked Microsoft to confirm whether all of the Complainant’s personal data
(including the copy of the Complainant’s identity card) had been deleted and, if not, to provide a
reason ag to why the deletion had not taken place. The DPC also requested whether Microsoft
had fulfilled the Complainant's right to be forgotten in a manner consistent with Article 17 of the
GDPR and, if so, to provide evidence of such. The DPC requested Microsoft to respond to its
queries by 14 February 2022. On 14 February 2022 Microsoft confirmed to the DPC that it had
accepted the URL for delisting and entered a manual request on behalf of the Complainant.
On 24 February 2022 the DPC wrote to Microsoft to request confirmation the personal data of the
Complainant, including the copy of the Complainant’s identity card, had been deleted as
requested. The DPC reminded Microsoft of its communication of 1 February 2022 requesting
confirmation of the deletion of the Complainant’s personal data. The DPC requested Microsoft to
confirm, within one week of the date of the DPC’s email, the deletion of all of the Complainant’s
personal data and, if this had not happened, the reasons why deletion had not occurred.
The DPC contacted Microsoft by email on 9 March 2022 to remind it of the request stipulated in
the communication of 24 February 2022 and requested Microsoft to respond by 16 March 2022.
On 14 March 2022 Microsoft confirmed to the DPC it had removed the personal data of the
Complainant, including the copy of the identity documents, from its systems. Microsoft noted
however some details were retained, primarily the name of the Complainant, to ensure it had
records of the delisting requests submitted to Microsoft.
14.
15.
16.
17.
18.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission °
The DPC informed the Complainant on 29 March 2022 via the Bavarian SA of Microsoft’s deletion
of all of his personal data including the identity documents. The DPC further noted the information
provided by Microsoft regarding the retention of certain details, such as the Complainant’s name,
to ensure it had records of delisting requests submitted. The DPC’s correspondence stated that, if
the Complainant believed the information provided facilitated the resolution of his Complaint
about Microsoft, that pursuant to section 109(3) of the Act, the DPC would deem the Complaint
withdrawn and close the file on the matter. It requested that, should the Complainant remain
dissatisfied, that he set out the reasons for this within two months of the date of the letter, so
that the DPC could take further action. l
On 12 April 2022 the DPC received the Complainant’s rejection of amicable resolution of 11 April
2022 from the Bavarian SA, citing his dissatisfaction with the handling of his erasure request by
Microsoft, notably the length of time it took for Microsoft to action his erasure request. The
Complainant also raised a concern about the possible disclosure of his personal data to third
parties, and about alleged criminal activity involving his website for a period of what he said was
almost one year before Microsoft actioned his erasure request.
The DPC notified Microsoft of the Complainant's rejection of amicable resolution on 14 June 2022.
The DPC requested Microsoft to respond to queries by 28 June 2022. The DPC asked Microsoft to
outline the lawful basis Microsoft relied upon to retain the Complainant’s name, as well as to
respond to the concerns outlined by the Complainant in his response rejecting amicable
resolution.
On 28 June 2022 Microsoft responded to the DPC and outlined that it retained a record of the
Complainant’s name to delist URLs associated with the Complainant’s name. Microsoft confirmed
that it had complied with the Complainant’s erasure request by deleting additional documentation
along with the Complainant’s personal data that was not relevant to the ongoing management bf
his erasure requests. Microsoft informed the DPC that it had contacted the Complainant directly
with the aforementioned information in the interest of amicably resolving the Complaint. The DPC
forwarded Microsoft’s responses to the Complainant’s concerns to the Bavarian SA on 5 July 2022
for communication to the Complainant and requested a response within two months from the
date of receipt of the letter. Ui
On 13 September 2022, the Complainant, via the Bavarian SA, requested an extension of time to
respond until 30 October 2022. The Complainant reverted to the DPC on 12 October 2022 via the
Bavarian SA with his further rejection of amicable resolution, citing the length of time it took
Microsoft to action his erasure request, as well as the initial response by Microsoft to the erasure
request. The DPC forwarded the Complainant’s response to Microsoft on 3 February 2023. The
DPC requested that Microsoft explain what it meant in reference to the term “primarily” in
Microsoft’s correspondence of 14 March 2022 regarding the purposes for which it retained some
personal data, and to outline the personal data retained in relation to the Complainant in addition
to his name. The DPC requested Microsoft to respond by 17 February 2023. On 16 February 2023
Microsoft responded to the DPC’s queries. It informed the DPC the information retained in
addition to the Complainant’s name was the details of the requests, including the name, contact
19.
20.
21.
22.
23!
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
details, the URLs requested to be delisted, any other details relevant to the request and
Microsoft's decision on each request.
On 5 April 2023 the DPC wrote to Microsoft to inform it that, despite the DPC’s efforts to date in
its complaint-handling process, it had not proven possible to reach an amicable resolution to the
Complaint, and that the case would now proceed to a draft decision.
Gn 5 May 2023 the DPC sent an update to the Complainant via the Bavarian SA noting that the
DPC continued to investigate his Complaint and that he would be provided with periodic updates
as the matter progressed.
On 9 May 2023 the Bavarian SA sent an update to the DPC informing it that the Complainant could
no longer be contacted via the email address he provided to the Bavarian SA in November 2022.
The Bavarian SA stated it had carried out a civil register check and this was unsuccessful. The
Bavarian SA stated it could not contact nor locate the Complainant.
On 27 June 2023, the DPC received a letter dated 21 June 2023 from the Bavarian SA, in which it
further communicated to the DPC the impossibility of communicating with the Complainant due
to having no postal address on record for him and no working e-mail address. The Bavarian SA
further noted the proceedings should be brought to a conclusion as it could not be ruled out that
the Complainant would inquire about the proceedings using a new address/e-mail address and
that a decision could then be communicated to him.
The following issue remained unresolved at the conclusion of complaint handling:
e Whether Microsoft’s handling of the Complainant’s erasure requests was compliant with
Articles 12 and 17 of the GDPR.
Conduct of Inquiry
24.
25.
26.
271
Acting in its capacity as LSA, the DPC commenced an Inquiry in relation to this matter by writing
to Microsoft on 29 June 2023.
The DPC advised Microsoft that the Inquiry commenced by the Commencement Notice would
seek to examine and address whether Microsoft had complied with its obligations under the GDPR
and the Act, in particular under Articles 12 and 17 of the GDPR in respect of the relevant processing
operations which are the subject matter of the Complaint.
In order to progress the matter, the DPC posed specific queries regarding the erasure requests
and the manner in which they were handled by Microsoft.
The DPC also sought to inform the Complainant, via a letter sent to the Bavarian SA (for transfer
to the Complainant) on 29 June 2023, that an Inquiry had commenced in relation to his Complaint
and posed a series of queries in relation to the Complaint. The DPC requested the Complainant to
28.
29,
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
provide a copy of all communications received from and sent to Microsoft in relation to the
Complaint, as well as the date the Complainant was informed by Microsoft that it had taken action
on the Complainant’s erasure request, including the de-listing of the URLs the Complainant had
included in his erasure request. '
The Bavarian SA informed the DPC on 4 July 2023, following receipt of the Commencement Notice
intended for the Complainant: “Initially, he had informed us at the end of 2022 that he would no
longer be reachable at the previous postal address and that he would like letters to be delivered
by e-mail in the future. As we have now discovered, the e-mail address of the complainant is also
no longer functional and delivery by e-mail can also no longer take place.” \t added that it
unfortunately saw “no possibility’ of sending the Complainant the DPC’s correspondence of 29
June 2023. The DPC was therefore unable to clarify certain details pertaining to the Complainant’s
account of these matters.
On 21 July 2023 Microsoft responded to the queries raised by the DPC in its Commencement
Notice. In its response Microsoft provided a comprehensive chronology of events, as set out
below.
Microsoft’s chronology of events is as follows:
“22 Mar-2021 — Right to be forgotten (RtBF) form submitted by the data subject requesting
removal of four URLs.
27 Mar-2021 — Microsoft replied to the data subject confirming acceptance of removal of two
URLs and rejecting removal of two URLs.
09-Oct-2021 — RtBF form submitted by the data subject requesting removal of three URLs.
17-Oct-2021 — Microsoft replied to the data subject rejecting the request for the three URLs.
03-Mar-2022 — Data subject contacted Microsoft's Privacy Response Centre (PRC) making an
access request.
03-Mar-2022 — Microsoft’s PRC replied to data subject with details on how they could
authenticate the ownership of the data to receive a copy of the requested data.
04-Mar-2022 — Data subject informed the PRC that their request related to an old phone
number, and they wanted to know how they could receive a copy of the data.
04-Mar-2022 — Microsoft’s PRC confirmed that once the data subject authenticates ownership
of data, the search for data would initiate. Microsoft’s PRC also informed the data subject that
Microsoft cannot provide information tied to a phone number for which the data subject
cannot authenticate ownership.
07-Mar-2022 — Data subject informed Microsoft that their request related to old phone
number and emails, and they could authenticate ownership. Additionally, the data subject
mentioned data that was not removed from Microsoft’s search engine (Bing), and repeated
their access request, so they could confirm what they would likely want deleted.
09-Mar-2022 — Microsoft’s PRC reiterated that we require authentication of ownership to
provide data related to a data subject. Additionally, our agent also provided information on
how the data subject could exercise their right for erasure related to information presented by
Bing.
30.
31.
32.
Chosaint Sonrai
Data Protection
Commission
10-Mar-2022 — Data subject informed Microsoft they had uploaded valid identification
documentation and that Microsoft didn’t confirm deletion of this data.
10-Mar-2022 Microsoft’s PRC requested the support ticket numbers for them to investigate
the data subject’s complaint.
10-Mar-2022 — The data subject provided one support ticket number for investigation.
> 14-Mar-2022 — Microsoft’s PRC confirmed receipt of the support ticket number.
15-Mar-2022 — Microsoft’s PRC informed the data subject of the resolution of the data
subject’s support ticket confirming two URLs were accepted for removal and two URLs were
rejected for removal.
15-Mar-2022 — Data subject requested confirmation that the data deletion request previously
submitted had been actioned.
25-Mar-2022 — Microsoft’s PRC confirmed that from the four URLs the data subject submitted
for removal, two were accepted and two were rejected.
26-Mar-2022 — Data subject claimed there had been a misunderstanding of their request and
they are inquiring about the data they provided for the RtBF request.
30-Mar-2022 — Microsoft’s PRC requested additional support ticket numbers to further
investigate the data subject’s complaint.
31-Mar-2022 — Data subject provided additional support ticket number.
05-Apr-2022 — Microsoft’s PRC provided a copy of correspondence previously sent to the data
subject confirming that in this second instance, three URLs were accepted for blocking and one
URL was rejected.”
The DPC notes that the timelines submitted by the Complainant and Microsoft differ slightly as
regards the dates some communications took place between Microsoft and the Complainant.
However both timelines support the fact that erasure requests were made on 22 March 2021 and
in or around the 9 October 2021 and it is those two erasure requests that the DPC is considering
for the purposes of the findings in this Decision.
In response to the DPC’s query on the channel through which the Complainant's erasure requests
were received, Microsoft informed the DPC it had received the erasure requests from the
Complainant initially via the Right to be Forgotten (RtBF) form, and subsequently through the
Microsoft DPO’s email address when the DPC contacted Microsoft on 12 November 2021.
Microsoft noted the Complainant further communicated with the Microsoft Privacy Response
Channel in relation to what appeared to be an access request, but which the Complainant later
clarified as an RtBF request.
As regards the DPC’s query on Microsoft’s compliance with Articles 12(3) and 12(4), in responding
to the Complainant’s erasure requests pursuant to Article 17 of the GDPR, Microsoft stated it
believed it had complied with these Articles. Microsoft stated its teams had communicated,
without undue delay, with the Complainant and, where Microsoft required further information to
assist with the Complainant’s request, Microsoft’s support agents communicated promptly with
the data subject to request clarifications of the Complainant’s request. Microsoft stated it had
reviewed all correspondence with the Complainant available in its systems but could not locate
any correspondence with dates 26 March 2021 and 17 October 2021, (as stated by the DPC in its
33.
34,
35.
36.
37.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
understanding of the timeline based on the information provided to the DPC by the Complainant)
and was therefore unable to comment. -
Following a request from the DPC, Microsoft clarified on 8 August 2023 that it specifically could
not locate any correspondence from the data subject to Microsoft with dates 26 March 2021 and
17 October 2021. It confirmed based on additional correspondence provided to it by the DPC that
the 26 March 2021 correspondence regarding case SRX[redacted] was no longer available on its
systems, so it could not comment on this matter. It also confirmed it could not locate the
correspondence from the data subject to Microsoft on 17 October 2021 and could not comment
on this matter. Microsoft said that, upon review, it identified that in its earlier response to the
DPC, correspondence that was sent from Microsoft to the data subject on 26 March 2021,
regarding case 5-0000[redacted], was incorrectly dated as 27 March 2021. The DPC does not
consider that this error in the date has any material bearing on the factual matters.
In response to the DPC’s query regarding a delay, if any, in complying with the Complainant’s
erasure request(s) within one month of receipt of the request(s), Microsoft stated that when the
Complainant submitted a request via the general privacy forum, the agents had difficulty
ascertaining what the Complaint was related to, based on the details provided, which made
triaging the request challenging. Microsoft further stated that the communication between the
privacy agents and the Complainant was ongoing from 3 March 2022 to 5 April 2022, at which
point the customer ceased any further communications. Microsoft stated there were no delays in
complying with the Complainant’s erasure request(s). Microsoft noted all URLs submitted for
blocking under the RtBF form were actioned within the required timeframe. All documentation
submitted by the Complainant with his RtBF requests, including ID verification, was automatically
deleted as per Microsoft’s retention policy 60 days after case resolution. Microsoft noted the
timeframe in which the requests and ID verification was deleted aligned with the requirements of
Article 5(1)(e) of the GDPR, i.e. the storage limitation principle.
In response to the DPC’s query as to the date Microsoft had completed the erasure of the
Complainant’s personal data, Microsoft outlined a timeline of the dates on which erasure took
place. According to the timeline provided by Microsoft, erasure commenced on 27 March 2021
and concluded on 5 April 2022. Microsoft noted it automatically deletes all documentation
associated with a RtBF request, including ID verification, within 60 days of case resolution and that
therefore, the copies of the ID provided by the Complainant in respect of certain requests had
been respectively deleted on 31 May 2021 and 8 December 2021.
As regards the DPC’s query on the categories of the Complainant’s personal data deleted by
Microsoft, Microsoft noted the categories of personal data deleted from Microsoft’s systems as a
result of the Complainant’s erasure request were all documentation, including ID verification, that
was included at the time of each RtBF submission as well as any approved URLs from Bing search
results in the EU for the queries specified.
Microsoft, as part of its response to the DPC query on the modalities available to data subjects to
exercise their rights under Article 17 of the GDPR (including details of portals, hyperlinks, phone
numbers, web forms and other means by which the individuals may contact Microsoft with such
«
+ US
38.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
requests), provided the DPC with the requested information. Microsoft informed the DPC that
Microsoft users can make GDPR-related requests when [they] are logged onto their account via
the Privacy Dashboard, accessible via the URL:
https://account.microsoft.com/account/privacy?ru=https%3A%2F%2Faccount.microsoft.com%2F
privacy&destrt=privacy-dashboard.
In addition Microsoft has a dedicated portal to assist data subjects to exercise their GDPR rights
which include erasure requests under Article 17, at the following address:
https://www.microsoft.com/en-ie/concern/privacy.
Microsoft stated that EU/EEA residents can also submit a RtBF request using the Request Form to
Block Search results in Europe, found at this address:
https://www.bing.com/webmaster/tools/eu-privacy-request
Additionally Microsoft stated that data subjects can report concerns through the form Report a
Concern to Bing Europe:
https://www.microsoft.com/en-us/concern/bing
Microsoft stated that the Microsoft Privacy Statement provides information on how to contact
Microsoft in the section “How to contact us” and that data subjects can locate the Microsoft
European Data Protection Officer under GDPR on the Microsoft Learn webpage within the
Microsoft Compliance section.
Microsoft informed the DPC that where data subjects contact it via postal letters, calls to non-
dedicated phone numbers and emails, as well as via official Microsoft social medias, Microsoft
employees, managing these channels have received training and provide the necessary
information to direct the data subject’s requests to the Microsoft privacy support team (Microsoft
PRC). Microsoft stated that if a request contains sufficient details to be identified as specifically
related to the right to be forgotten, employees will share the request with the Bing Content
Moderation Operations team.
In response to the DPC’s query, Microsoft provided the details of its procedures for identifying
and for escalating subject requests under the GDPR to the correct channels including where such
requests may be submitted by post or through customer service or other non-DPO channels.
Microsoft stated it provides annual training to employees on privacy compliance requirements,
including the GDPR. Additional training is provided to customer support agents to empower them
to identify and properly escalate privacy requests they may receive on the channels they support.
Microsoft noted it makes available to employees guidance material on how to handle customer
inquiries relating to personal data subject rights and other privacy protection related questions.
Microsoft informed this Inquiry that this material is updated as needed. Further, Microsoft noted
it provided specific refresher trainings and updated guidance material to provide support to
agents whenever needed so as to improve identification of privacy protection related questions
and to ensure their proper handling.
10
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
Notification of Preliminary Draft Decision to the Controller a
39.
40.
41.
42.
43.
The DPC provided Microsoft a copy of the Preliminary Draft Decision on 23 August 2023 and
requested that Microsoft provide submissions in relation to the content by close of business on
15 September 2023.
In its response of 15 September Microsoft informed the DPC that as regards its preliminary
findings in relation to Microsoft's infringement of Article 12(4) in failing to inform the Complainant
of his right to a judicial remedy, that it had begun to implement the language requested in the
Preliminary Draft Decision.
i}
Microsoft further provided on 15 September 2023, in relation to the preliminary finding as regards
Microsoft’s failure to take action on the erasure request of 9 October 2021, the following
information:
“The URLs submitted for removal on October 9, 2021, were found to be ineligible for removal
because we determined that there was a significant public interest in accessing this information
as it related to the data subject’s working life. The data subject was notified of our decision and
the case was closed without undue delay by October 17, 2021. The data subject resubmitted the
URLs on November 19, 2021, and the team reassessed the content and determined that it was
eligible for removal and accepted blockage at that time and the data subject was notified of our
decision and the case was closed without undue delay by November 26, 2021. The data subject
resubmitted the same URLs for a third time on March 1, 2022, and we accepted blockage again
and the data subject was notified of our decision and the case was closed without undue delay on
March 6, 2022. See Appendix 1. The one-month deadline to comply reset each time that the URLs
were resubmitted for evaluation. The data subject also submitted a request via Microsoft’s general
privacy form and, due to the lack of clarity in the details provided, there was difficulty
understanding the substance of the request leading to an extended response time.”
t
The DPC put further queries to Microsoft on 21 September 2023. The DPC requested that
Microsoft confirm the date on which the URLs submitted as part of the Complainant’s erasure
request of 9 October 2021 were erased and that it identify the URLs that were erased. The DPC
also asked Microsoft to confirm whether the same three URLs were available in internet search
results as of 1 March 2022, when they were submitted for a third time by the Complainant. The
DPC requested that Microsoft respond to these queries by 29 September 2023.
On 29 September 2023, Microsoft responded to the DPC’s further queries. Microsoft stated the
URLs submitted for removal on 9 October 2021, were originally rejected for blocking because the
URLs related to the data subject’s work life. The URLs were not approved for blocking until
Microsoft submitted an internal RtBF request on behalf of the data subject in response to the
DPC’s letter of 12 November 2021. The URLs were approved and submitted for blocking of the
data subject’s name no later than 26 November 2021. The URLs that were blocked for searches
of the data subject’s name are as follows:
https.[redacted1].pdf
41
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
https.[redacted2].pdf
and
https.[redacted3].pdf
On 5 October 2023 the DPC requested that Microsoft confirm the exact date on which the URLs
were blocked, i.e. the date on which they were no longer available in an internet search result. On
6 October 2023 Microsoft responded and informed the DPC that it was “unable to confirm the
exact date on which the URLs would no longer have been presenting in search results, given the
way our technology operates. Our estimates are based on what we have seen with similar delisting
requests. The delisting requests were indeed processed twice, once in October, and once in March.
This was out of an abundance of caution on Microsoft's part.”
Notification of Preliminary Draft Decision to the Complainant
45.
On 12 September 2023 the DPC attempted to provide the Complainant, via the Bavarian SA, with
a copy of the Preliminary Draft Decision. In its correspondence, the DPC also invited the
Complainant to provide their submissions on the Preliminary Draft Decision and provided a
deadline of two weeks from the date of receipt of the Preliminary Draft Decision. The Bavarian SA
contacted the DPC on 13 September 2023 and informed the DPC that, unfortunately, it could not
issue the update [the Preliminary Draft Decision] to the Complainant. It stated that a civil register
check carried out in relation to the Complainant in May had been unsuccessful. As a result, it could
not contact the Complainant by post and the email address he had provided to it was still invalid.
Relevant and Reasoned Objections and Comments from “supervisory authorities concerned”
46.
. Having transmitted the Preliminary Draft Decision on 13 October 2023 to the “supervisory
authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC did not subsequently
receive any relevant or reasoned objections or comments under Article 60(4).
|
Applicable Law
47.
48.
. For the purposes of its examination and assessment of this Complaint, the DPC has considered the
following Articles of the GDPR:
e Article 12
e Article 17
Facts Established, Analysis and Findings of Inquiry
! This section analyses the facts established in the Inquiry and whether Microsoft’s handling of the
Complainant's erasure requests was compliant with Articles 12 and 17 of the GDPR.
The relevant legal provisions are as follows:
12
49.
50.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
According to Article 12(3) of the GDPR, the controller shall provide information on action taken
on a request under Articles 15 to 22 to the data subject without undue delay and in any event
within one month of receipt of the request.
Article 12(4) of the GDPR provides that, if the controller does not take action on the request of
the data subject, the controller shall inform the data subject without delay and at the latest
within one month of receipt of the request of the reasons for not taking action and on the
possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
According to Article 17 of the GDPR, the data subject shall have the right to obtain from the
controller the erasure of personal data concerning him or her without undue delay. ;
The DPC understands the Complainant submitted at least two erasure requests and, as part of
those requests, stated “Please delete all pages, data, storage within 48 hours and files submitted
by me in accordance with the GDPR. Onward transfer to third parties is not allowed. | would be
grateful if you could confirm this.” .
The DPC is satisfied from the submissions provided that two distinct erasure requests were
submitted by the Complainant, one on 22 March 2021 (“the March Request”), and a second
request on 9 October 2021 (“the October Request’).
The March Request:
51.
On 22 March 2021 the Complainant requested the removal of four URLs from the Bing sear¢h
engine (outlined below in Table 1).
Table 1: 22 March 2021 erasure request
52.
53.
URLs Address
URL1_ | https://www.[redacted].html
URL2_ | https://www.[redacted].er
URL3 _| https://.wwwiredacted] RE
URL4 | https://www.[redacted].de
As regards the March Request, the DPC understands that Microsoft accepted the deletion of two
of the four URLs submitted for deletion (i.e. URL 1 and URL 2 above). As regards URL 3 and URL 4,
Microsoft specified the reason for rejection of the deletion of these URLs was due to “public
interest in accessing this information outweighs [the Complainant's] interest in privacy.” Microsoft
informed the Complainant of its decision on 27 March 2021, within five days of the request.
As can be understood from the submissions, Microsoft commenced erasure on 22 March 2021
and completed erasure of URL 1 and URL 2 of the March Request on 27 March 2021 (as outlined
in Table 2 below). Microsoft provided the Complainant with the specific reason for rejection pf
erasure of URL3 and URL4 on 5 April 2022. It said the initial reason for rejection of URL 4 was due
to the fact it was a dead link. Microsoft told the Complainant that the URL had since been blocked
[from search results]. The reason for rejection of URL 3 was due to the fact the URL led to a search
engine results page and was not a specific URL [i.e. a URL relating to the Complainant].
13
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
Table 2: Timeline of erasure for March Request
Date of erasure Eracive Cowiwenced Erasure URLs
request Completed
22 March 2021 27-Mar-2021 27-Mar-2021 https://www.[redacted].html
22 March 2021 27-Mar-2021 27-Mar-2021 https://www.[redacted].er
"22 March 2021 Rejected Rejected https://.www[redacted].RE
22 March 2021 | Initially rejected 27-Mar-2021 | 05-Apr-2022 https://www.[redacted].de
54. Due to the impossibility of clarifying the Complainant's submissions with him, as explained above
55.
56.
57.
58.
in paragraph 28, and the fact the DPC has not had an opportunity to receive any further
submissions from the Complainant, the DPC has not seen the original wording of the March
Request. It is not clear, therefore, whether the Complainant’s request of 22 March 2021 made
clear that the domain name in question, a publicly available website, was owned by the
Complainant. It is also not clear whether the Complainant requested erasure of all URLs associated
with that domain name appearing in Bing search results. While the Complainant’s intention may,
as early as 22 March 2021, have been to seek erasure of all pages related to his own website
domain, the DPC cannot confirm this with him and has no evidence in writing to determine what
his intentions were. The DPC does not therefore propose to consider further whether Microsoft’s
refusal to de-list the domain name as part of the March Request due to public interest in accessing
it was justified. The DPC understands in any case that after it engaged with Microsoft, it delisted
the domain name specified in URL 4 on 5 April 2022, as outlined below in Table 3 of this Decision.
The DPC will also not further consider URL 3 of the March Request as Microsoft’s explanation
made clear that this was merely a Bing search page which returns results based on the input of a
search term.
According to Microsoft, it deleted all URLs submitted for erasure within the required timeframe,
as per its submissions in response to the DPC’s queries. The DPC accepts that the March Request
was carried out without undue delay, and that any reason for rejection was explained to the
Complainant.
As per the timeline provided by Microsoft, outlined at paragraph 29, Microsoft responded to the
Complainant's first erasure request, the March request, within 5 days of receipt. Throughout its
communications with the Complainant, Microsoft informed the Complainant of the steps taken,
or not taken, in response to his requests. Microsoft regularly provided the Complainant with
information on action taken, or in certain instances any action not taken, on his erasure request.
Microsoft provided the Complainant with information on the possibility of lodging a complaint
with a supervisory authority when it rejected the request for erasure of two of the URLs in the
March Request. However, from the information provided to the DPC, Microsoft did not inform the
Complainant of his right to_a ju |_ remedy at_any stage of its communi ins_with the
Complainant in its partial rejection on 27 March 2021 of his 22 March 2021 erasure request.
14
59.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
FINDING 1: On the basis of the above, the DPC finds that Microsoft infringed Article 12(4) of the
GDPR on 27 March 2021 as it failed to provide the Complainant with information that he had a
right to seek a judicial remedy, in circumstances where it was refusing, or partly refusing, to take
action on the erasure request made by the Complainant on 22 March 2021.
The October Request ,
60.
61.
The DPC is satisfied from the submissions provided by Microsoft to this Inquiry that there was also
a specific request for erasure submitted by the Complainant on 9 October 2021 in relation to the
three URLs listed below in Table 3.
Table 3: 9 October 2021 erasure request
URLs Address
URL1 https://[redacted1].pdf
URL2__| https://[redacted2].pdf
URL3 _| https://{redacted3].pdf
As regards the Complainant’s October Request, the DPC understands Microsoft rejected the
request to erase the three URLs specified above in Table 3 on 17 October 2021, informing the
Complainant of its decision within eight days of his request. Microsoft stated it had “reviewed [the
Complainant's] application and determined that there is a significant public interest in accessing
this information as it relates to [the Complainant’s] working life. We have therefore decided not
to take any action for these URLs...
However, it later transpired that this decision by Microsoft not to take any action was an error by
its intake team. The DPC contacted Microsoft on 12 November 2021 regarding the
commencement of the complaint-handling procedure. The DPC made specific reference to the
URLs of the October request and requested Microsoft to provide the Complainant with further
details regarding the reasons why the delisting of the pertinent URLs had been refused by 29
November 2021. On 29 November 2021, Microsoft responded to the DPC and informed the DPC
that its intake team had rejected the [October] request when it should have accepted it antl had
the content delisted. Microsoft informed the DPC it was working to delist the content and that it
should be taken down in the coming days.
However, as can be seen below in Table 4 Microsoft’s Timeline of erasure for the October Request,
in respect of the October request, and based on the DPC’s follow-up queries to Microsoft, the DPC
understands that the erasure of those URLs may not have been fully completed until 6 March
2022. From the information provided by Microsoft, the DPC therefore understands that erasure
of the October request URLs began on 26 November 2021 (49 days after receipt of the erasure
request) and that the de-listing process was not fully completed until 6 March 2022 (almost five
months after receipt of the erasure request). This assessment is based on the information
provided by Microsoft that the Complainant resubmitted a request for de-listing to Microsoft on
1 March 20221.
1 Paragraph 41 < si
15
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
1
Table 4: Timeline of erasure for October Request
Date of
Request Erasure
erasure Geatun Gomarcunead Erasure Completed URLs
request
Initial https[redacted1].pdf
9 rejection -
October | 17-October | 7° November no later than 6 March 2022
2021 2021
g Initial https[redacted2].pdf
rejection- | 26 November
paobet i october pas no later than 6 March 2022
2021
9 Initial https[redacted3].pdf
rejection- | 26 November
abet ig ocisher est no later than 6 March 2022
2021
62. The DPC notes a further URL related to a page on the www.[redacted].de domain, was submitted
63.
64.
65.
for erasure on 1 February 2022 following a request to Microsoft by the DPC and erasure was
completed by 6 March 2022.
According to Article 12(4), the controller, if it does not take action on the request of the data
subject, shall inform the data subject without undue delay and at the latest within one month of
receipt of the request of the reasons for not taking action and on the possibility of lodging a
complaint with a supervisory authority and seeking a judicial remedy.
Microsoft provided the Complainant with information on the possibility of lodging a complaint
with a supervisory authority on 17 October 2021 when it rejected his 9 October 2021 request for
erasure of three particular URLs. However, from the information provided to the DPC, Microsoft
did not inform the Complainant of his right to a judicial remedy on that date.
Following receipt of Microsoft’s submissions on the Preliminary Draft Decision, and its
disagreement with the proposed finding of infringement of Article 17, the DPC twice sought
clarification on the issue of when exactly those three URLs would no longer have been available
in a search result. Microsoft was unable to clarify this. However, as Microsoft had in any case
accepted that the three URLs should originally have been accepted for de-listing when the
Complainant made his request on 9 October 2021, the DPC finds that Microsoft infringed Article
17 of the GDPR as it did not act on the Complainant’s request “without undue delay’. The de-
! listing of the three URLs in the October Request did not commence until 26 November 2021, after
the DPC had notified Microsoft of the Complaint, at which time Microsoft established that the
URLs should have originally been accepted for delisting when the Complainant made his request
on 9 October 2021. On this basis the DPC finds that Microsoft did not act on the Complainant’s 9
October 2021 request without undue delay, as required by Article 17.
16
66.
67.
68.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission.
FINDING 2: On the basis of the above, the DPC finds that Microsoft infringed Article 12(4) of the
GDPR on 17 October 2021 as it failed to provide the Complainant with information that he had
a right to seek a judicial remedy, in circumstances where it was refusing, or partly refusing, to
take action on the erasure request made by the Complainant on 9 October 2021.
FINDING 3: On the basis of the above, the DPC finds that Microsoft infringed Article 17 of the
GDPR as it failed to correctly action the Complainant’s 9 October 2021 erasure request and did
not commence the de-listing process until 26 November 2021, 49 days after receipt of the
request.
As Microsoft accepted that the URLs in this request should have been identified in the first
instance as eligible for delisting, and as it was unable to clarify with certainty when the URLs
were no longer available in search results, Microsoft infringed Article 17 as it failed to erase the
Complainant’s personal data, i.e. the three URLs listed in the 9 October 2021 erasure request,
without undue delay. .
Summary of Decision on infringements of the GDPR
69.
°
Following the investigation of the Complaint against Microsoft, the DPC finds that Microsoft
infringed the General Data Protection Regulation as follows:
Article 12(4) of the GDPR
i
The DPC finds that Microsoft infringed Article 12(4) of the GDPR on 27 March 2021 by failing to
inform the Complainant of the possibility of seeking a judicial remedy when it responded to him
outlining the reasons for not taking action, in part, on his erasure request.
Article 12(4) of the GDPR
The DPC finds that Microsoft infringed Article 12(4) of the GDPR on 17 October 2021 by failing to
inform the Complainant of the possibility of seeking a judicial remedy when it responded to him
outlining the reasons for not taking action on his erasure request. t
Article 17 of the GDPR
The DPC finds that Microsoft infringed Article 17 of the GDPR by failing to erase personal data
that were the subject of the Complainant's erasure request of 9 October 2021 without undue
delay.
Remedial measures undertaken by Microsoft
70.
The DPC notes Microsoft’s statement provided in its submission as regards the training provided
to agents, including annual training on privacy compliance, guidance material to handle customer
inquiries and refresher training to improve identification of privacy protection-related questions
and ensure proper handling of subject rights requests under the GDPR.
17
71.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
The DPC further notes Microsoft’s commencement of modification to the language used in
‘response to data subjects’ rights requests received to ensure the data subject is aware of their
rights. Microsoft has stated it is in the early stages of implementing the language the DPC had
noted was lacking in its preliminary findings in the Preliminary Draft Decision.
Judicial Remedies
72.
1
In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective
judicial remedy against a legally binding decision of a supervisory authority concerning them.
Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court
may be taken by a data subject or any other person (this includes a data controller) affected by a
legally binding decision of the DPC within 28 days of receipt of notification of such decision. An
appeal may also be taken by a data controller within 28 days of notification; under Section 150(1)
against the issuing of an enforcement notice and/or information notice by the DPC against the
data controller; and under Section 142, against imposition upon it of an administrative fine by the
DPC.
Exercise of Corrective Powers by the DPC
73,
74,
75:
2
In deciding on the corrective powers that are to be exercised in respect of the infringements of
the GDPR outlined above, | have had due regard to the Commission’s power to impose
administrative fines pursuant to Section 141 of the 2018 Act. In particular, | have considered the
criteria set out in Article 83(2) (a) — (k) of the GDPR. When imposing corrective powers, | am
Obliged ta select the measures that are effective, proportionate and dissuasive in response to the
particular infringements. The assessment of what is effective, proportionate and dissuasive must
be made in the context of the objective pursued by the corrective measures, for example re-
establishing compliance with the GDPR or punishing unlawful behaviour (or both)’. | find that an
administrative fine would not be necessary, proportionate or dissuasive in the particular
circumstances in relation to the infringements of the Articles of the GDPR as set out above.
In light of the extent of the infringements identified above, the DPC hereby issues a reprimand
to Microsoft, pursuant to Article 58(2)(b) of the GDPR.
In light of the infringements of Articles 12(4) and 17 in the case of this data subject, | find it
necessary that the controller bring its processing into compliance to prevent similar
infringements occurring with regard to data subjects in the future in similar circumstances.
Accordingly, the DPC proposes to order Microsoft to revise its internal policies and procedures
as regards the information to be provided to data subjects pursuant to Article 12, to ensure that,
where it informs data subjects on foot of requests made under Articles 15 to 22 of the GDPR
that it has decided not to take action on the request, that data subjects are informed in all cases
of their right to seek a judicial remedy. This order is made pursuant to the DPC’s corrective
powers under Article 58(2)(d) of the GDPR. Microsoft is requested to provide details of its
revised internal policies and procedures to the DPC by 7 February 2024.
Article 29 Data Protection Working Party ‘Guidelines on the application and setting of administrative fines for
the purposes of Regulation 2016/679’, at page 11.
18
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
Signed:
Tony Delaney
Deputy Commissioner t
On behalf of the Data Protection Commission