gdpr
Are search keywords seen as non-personal information?
<p>For example someone is browsing a popular shop like Amazon, what does GDPR say about this?</p>

<blockquote>
<p>Are search keywords seen as non-personal information?</p>
</blockquote>
<p>The GDPR regulates the disclosure, storing, and usage of <em>personal</em> information, not the queries about natural persons. A natural person can prohibit a company from storing, disclosing, etc. his personal information, but it is not illegal for the company (or its agents) to conduct a search on that person. See also article 88 of the <a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj" rel="nofollow noreferrer">GDPR</a>.</p>
<blockquote>
<p>For example someone is browsing a popular shop like Amazon, what does GDPR say about this?</p>
</blockquote>
<p>The GDPR focuses on protecting matters such as <em>private and family life</em> (see recital 4).</p>
<p>I initially thought your question was only about the <em>searched</em> person. The GDPR prohibits processing that implements, or is intended to implement, a profiling of the natural person who browses sites.</p>
<p>That being said, the GDPR does not prohibit processing of other personal/identifying data about natural persons to whom some <em>legitimate</em> (as <a href="https://law.stackexchange.com/questions/57637/are-search-keywords-seen-as-non-personal-information/57660?noredirect=1#comment117817_57660">amon phrased it</a>) or <em>public interest</em> is attached, as would be the case of Amazon regarding an author's identifying information: processing of the author's data may be established as <em>necessary and proportionate</em> for Amazon's purposes.</p>

<p>Personal data is any information that relates to an identifiable person (the data subject). GDPR applies to any processing of such personal data, with some exceptions. The GDPR doesn't get very concrete on this, but we can try to apply these general principles.</p>
<p>So are search keywords personal data?</p>
<p>This hinges on whether the data subject is identifiable, and whether the keywords also relate to the data subject. A couple of scenarios:</p>
<ul>
<li><p>Search keywords are logged for statistical purposes, but the logs are not associated with any user. For example, the statistics might show that in a given timeframe, 134 people searched for “star wars” and 2 people searched for “pcie ssd”. Since the users who performed this search are not identifiable, the search keywords aren't personal data in the sense of the GDPR.</p>
</li>
<li><p>The same as the previous scenario, but some search keywords contain identifying information, e.g. if someone searches for their home address for some reason. The <em>identifiability</em> criterion is satisfied, but it's not clear that the statistics would <em>relate</em> to the users. This would probably depend on how exactly the keywords are used. Counted for some statistics? Probably fine. Publicly broadcasting that data in a “buyers are currently searching for: …” popup? Not a good idea.</p>
</li>
<li><p>When a user creates an account on the website, their search query history is stored in their profile. Now, these search keywords are not only clearly identifiable, but they also clearly relate to that user profile. They are clearly personal data in the sense of the GDPR.</p>
</li>
<li><p>Some search queries might identify a person, e.g. an author. It can be argued either way whether the author is a data subject of the search:</p>
<ul>
<li>While the search identifies the author, it doesn't relate to the author in the sense of the GDPR. Thus, the search wouldn't be the author's personal data.</li>
<li>The search clearly relates to the author and is the author's personal data. Nevertheless, GDPR wouldn't be an obstacle because there is a strong legitimate interest in processing this personal data for selling the author's books.</li>
</ul>
</li>
</ul>
<p>So depending on the exact scenario, the same search keywords might be both personal and non-personal data of different persons, e.g. users performing a search or persons whom the search is about. Whether data “relates” to a person depends not only on the data itself, but also on how the data is used. This makes sweeping statements rather difficult. But I would strongly assume that search queries on Google or Amazon are personal data, whereas search queries on DuckDuckGo are not.</p>
