Google Ordered to Provide Complete Data Copy After Incomplete GDPR Access Request
Written by AI from the linked story. Not reviewed by an editor. How this works
Google failed to fulfill a GDPR Article 15 data subject access request (DSAR) in its entirety, omitting personal data processed through cookies and third-party tracking pixels such as Facebook Pixel. This case highlights that organizations cannot selectively disclose only the data held in primary systems while ignoring data collected through behavioral tracking and third-party integrations. Incomplete DSARs are not merely a compliance oversight — they actively undermine individuals' rights to transparency and control over their personal data. Regulators are increasingly scrutinizing the completeness of data disclosures, and organizations that rely on self-service download portals must ensure those portals capture all personal data across every processing activity.
Tactical Insight
Immediate actions
- Audit all existing DSAR fulfillment processes to ensure they capture data from every source, including cookies, pixels, and third-party integrations.
- Establish a centralized personal data inventory (Record of Processing Activities) that maps all data flows, including tracking technologies.
Long-term improvements
- Implement a formal DSAR workflow with cross-functional reviews (legal, engineering, privacy) to validate completeness before responding.
- Conduct periodic privacy impact assessments (PIAs/DPIAs) to identify new data sources that must be included in future access requests.
- Invest in data discovery tooling capable of locating personal data across structured and unstructured sources, including third-party trackers.
Governance & compliance measures
- Assign a Data Protection Officer (DPO) or privacy lead to own and review DSAR response quality before submission.
- Train engineering and product teams to flag any new third-party data processing integrations to the privacy team for DSAR inclusion.