Does GDPR cover the collection of data by websites that crawl the web and resell user data
<p>I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it.
I'm talking about those 'find anything about anyone' websites.</p>

<p>A lot of the data is also inaccurate.</p>

<p>Since a lot of these companies are American and I have lived my life half US / half EU and I'm now an EU resident, I was wondering:</p>

<ul>
<li>does the GDPR applies to them?</li>
<li>does the GDPR applies to data they claim was 'public', but I see that this is not really true?</li>
<li>What's the responsibility of search engines, like Google, in indexing and promoting that content. As they seem to have a 'contact the webmaster' approach to it, is it possible to get the content (at the minimum the inacurate one) removed from their index?</li>
</ul>

<p>The GDPR applies to such sites if they offer services in the EU/EEA. If they clearly wanted to avoid being subject to the GDPR, they should block visitors from the EEA. For the GDPR, only location matters. Other concerns like residence or citizenship are generally irrelevant.</p>

<p>Personal data does not turn non-personal just because it was public. So the GDPR still applies when the data was collected from public sources. However, the data controller (who determines the purpose of processing) often has to balance your rights and interests against other interests (e.g. when using <em>legitimate interest</em> as a legal basis for some processing). For the purpose of publicly displaying your data, only showing data that was already public anyway makes it easier to argue that this is fine.</p>

<p>But when the GDPR applies, you have data subject rights. Relevant rights include:</p>

<ul>
<li>a right to access, to see all the data they have about you</li>
<li>a right to rectification, to correct wrong data they hold about you</li>
<li>a right to restriction, effectively an opt-out</li>
<li>a right to erasure (also known as the right to be forgotten)</li>
</ul>

<p>These rights apply both against the website and against Google Search (arguably, both are doing the exact same thing). Google correctly points out that they can't remove information from the Web, but they can hide information from search results.</p>

<p>If you feel that your requests have not been resolved correctly, you can issue a complaint with your country's data protection authority. In theory you can also sue them. In practice, GDPR enforcement against overseas data controllers can be quite difficult and has not yet happened.</p>

gdpr