The auto-complete function is not prohibited by GDPR, says the Danish data protection authority.

• The search function suggested certain search suggestions automatically including the complainant’s name.
•  The purpose of the function was to offer a better service to citizens.
• The municipality also stated that when a user performs a search only the entered keyword is stored in the search engine.
•  All keywords are stored as simple text strings, so it is basically impossible for the feature to distinguish whether the keyword is a personal name or something else.
• There is a built-in functionality that ensures that no social security numbers are displayed.

Datatilsynet DK held that the processing of the complainant’s name for the auto-complete is permitted as the processing is necessary for the performance of a task in the best interest of the community or is a matter of public authority imposed by the data controller. (Art 6(1)(e) GDPR, namely the search function as a tool to support the municipality’s compliance with the general duty of guidance towards the citizens.

Details from Datatilsynet.

[View source.]