The complaint concerned the individual’s dissatisfaction with Microsoft Ireland’s (data controller) response to their right to be forgotten request pursuant to Article 17 GDPR. The individual requested to have seven URLs delisted from being returned in a search against their name on the data controller’s search engine. The individual stated that their National Identity number was contained in the URLs returned and raised concerns that the availability of their National Identity number increased the risk of identity theft.

The DPC intervened on behalf of the complainant. The data controller originally refused the delisting request, stating that the URLs contained information of public relevance, and that the information was published in an official bulletin of a government body; in this case, the Spanish Government . The DPC corresponded with the Spanish Data Protection Authority in relation to the information published in the URLs . The Spanish Data Protection Authority stated that due to the introduction of the GDPR, the Spanish Data Protection law was modified and the Government is no longer permitted to disclose citizens’ complete National Identification number alongside their name and surnames when publicising administrative acts. Following clarification from the Spanish Data Protection Authority, the DPC informed the data controller of the change in the Spanish Data Protection law. The data controller stated that based on the update in Spanish Data Protection law, it would delist all requested URLs from being returned against the individual’s name in accordance with Article 17 GDPR . This case highlights the importance of communicating with other supervisory authorities during the complaint resolution process. In these circumstances, the DPC was provided with clarification on how Spain has adapted its national legislation to comply with the GDPR . It also allowed the data controller to adapt its current procedure to ensure that requests involving the delisting of URLs containing full National Identity numbers are handled in accordance with the updated national legislation.