Google Searches and the Data Protection Act

Gobán Saor

Firstly consider the following definitions from the 1988/2003 Data Protection Acts:

"data controller" means a person who, either alone or with others, controls the contents and use of personal data;

"data processor" means a person who processes personal data on behalf of a data controller but does not include an employee of a data controller who processes such data in the course of his employment;

“personal data” means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;

“processing”, of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including -

(a) obtaining, recording or keeping the information, or data
(b) collecting, organising, storing, altering or adapting the information or data,
(c) retrieving, consulting or using the information or data,
(d) disclosing the information or data by transmitting, disseminating or otherwise making it available, or
(e) aligning, combining, blocking, erasing or destroying the information or data;

Now consider the effects of doing a Google or other internet search for Joe Bloggs or Sean Citizen.

It seems that the following consequences ensue:

The output of the search engine is "personal data" within the meaning of the act.

The act of doing the search constitutes "processing" within the meaning of the Act.

Doing anything with the search results, including saving the data (deliberately or otherwise) to a hard disk makes one a "data controller" within the meaning of the act.

From which a whole host of things follow............:eek:

Discuss:D

johnnyskeleton

Gob&#225 wrote: »

Firstly consider the following definitions from the 1988/2003 Data Protection Acts:
...
Now consider the effects of doing a Google or other internet search for Joe Bloggs or Sean Citizen.

It seems that the following consequences ensue:

Interesting question. You might want to flesh out the circumstances of what information came up from the search, and where the information was from.

The output of the search engine is "personal data" within the meaning of the act.

Depends on the nature of the information and the website that contains it I suppose.

The act of doing the search constitutes "processing" within the meaning of the Act.

But is Google a data processor? Do they processes personal data on behalf of a data controller? Would it not be fairer to say that they process data that is publically published for their own business purposes as opposed to on behalf of the websites which they search?

Doing anything with the search results, including saving the data (deliberately or otherwise) to a hard disk makes one a "data controller" within the meaning of the act.

From which a whole host of things follow............:eek:

Discuss:D

Alright. First, I would say that processing data is not prohibited, but rather it should not be processed unfairly, for an unlawful purpose and otherwise within the terms of the act.

Second, where does the actual processing take place? I know google have offices in Ireland, but does the processing take place in a server in the US, or in the cayman islands etc? If so, I'm not sure the act would apply.

Third, I think it could be argued that google are not the ones who process the information, but rather google's website is used by the searcher to process the information. In that regard, google could be seen as no more of a processor than could the company which makes computer hard disks or even the paper on which data is printed.

Finally, if the information is kept by an individual for recreational purposes then it does not come within the terms of the act.