The auto-complete function is not prohibited by GDPR, says the Danish data protection authority.

  • The search function suggested certain search suggestions automatically including the complainant’s name.
  •  The purpose of the function was to offer a better service to citizens.
  • The municipality also stated that when a user performs a search only the entered keyword is stored in the search engine.
  •  All keywords are stored as simple text strings, so it is basically impossible for the feature to distinguish whether the keyword is a personal name or something else.
  • There is a built-in functionality that ensures that no social security numbers are displayed.

Datatilsynet DK held that the processing of the complainant’s name for the auto-complete is permitted as the processing is necessary for the performance of a task in the best interest of the community or is a matter of public authority imposed by the data controller. (Art 6(1)(e) GDPR, namely the search function as a tool to support the municipality’s compliance with the general duty of guidance towards the citizens.

Details from Datatilsynet.