You search for yourself on Google and find things you did not expect: a website showing your phone number and address, a list of candidates for a public exam from years ago, a directory of professionals you do not remember agreeing to, or a page that collects names taken from Spanish official gazettes. Put together and visible to anyone, these details can make harassment or fraud easier, or simply make you uncomfortable.
What kind of websites publish your details
- Phone and business directories, including listings of professionals.
- Websites that aggregate public information from official gazettes, registers or decisions.
- Lists from selection processes, grants, subsidies or sports results.
- Pages of professional bodies or old associations.
- People search sites, more common in other countries such as the US and the UK, which cross-reference data from different sources.
- Copies of documents uploaded by third parties: minutes, attendee lists, CVs.
Your rights
The GDPR gives you clear tools against anyone who publishes your data, and they apply whatever your nationality:
- Right of access: to know what data they hold about you and where they got it.
- Right to erasure (Article 17): to have it deleted when it is no longer needed, when it is processed unlawfully or when you object successfully.
- Right to object (Article 21): to object to processing on grounds relating to your particular situation when it is based on legitimate interest.
The fact that information was public at source, for example because it appeared in an official gazette, does not mean anyone can reuse it for any purpose and indefinitely.
Step by step
- Take stock. Search Google for your name in quotation marks, your phone number and your address. Note down every URL.
- Identify who is responsible for each website: the legal notice (in Spain, the "aviso legal"), privacy policy or contact form. Look for a privacy email address or the data protection officer.
- Send a written request to each website, identifying yourself and stating the URLs and the right you are exercising. You can write in English; many Spanish websites will reply in Spanish.
- Explain your reason in a few lines: that you did not consent to publication, that the data is out of date or that it exposes you to risks.
- Keep proof that you sent it and note the date. The controller has one month to reply, which can be extended by two further months in complex cases (Article 12.3 GDPR).
- Check the result and, if the page disappears but Google still shows it, use Google's tool to request removal of outdated content.
Tip
Use a common template and adapt it for each case. You will save time and make sure nothing is forgotten: identification, URLs, the right you are exercising and your reason. Do not send more personal documents than you need to identify yourself; a copy of your passport or NIE card with irrelevant details covered is usually enough.
If the website does not reply
Many small websites do not answer. In that case you have two options:
- Ask Google to stop showing those results when your name is searched, through the right to be forgotten, or to remove results containing personal contact details under its own policies.
- Complain to the AEPD, the Spanish Data Protection Agency (the Spanish equivalent of the UK's Information Commissioner's Office), with the request you sent and evidence that there was no reply.
If the website is hosted outside the European Union and has no representative here, search engines are usually the most practical route.
A special case: contact details on Google
Google has its own policies for removing certain personally identifiable information from its results, such as phone numbers, home addresses or personal email addresses, especially when publishing them could make harassment or fraud easier. This route does not depend on the original website deleting the data and can be very useful when the controller does not respond. It does not remove the page, but it makes it much harder for someone to reach it by searching for you.
Prevention, so you do not reappear
- Review the privacy settings on your social media: hide your phone number, email and friends list.
- Before signing up to a directory or a guide, read what they will publish.
- When you give your phone number on a form, untick the boxes allowing it to be passed to third parties.
- Search for your name again from time to time.
We can help you clean up your data
When your details are on many websites, the process is slow and repetitive. We can find them, send the requests and follow them up. We analyse your case for free, tell you what stands a chance (the final decision lies with each website or search engine) and give you a fixed quote. More information on removing personal information. We work in English, remotely, and handle the correspondence in Spanish on your behalf.
