Wanna force granny to take down that family photo from the internet? No problem. Europe's GDPR to the rescue A court in the Netherlands ruled this month that a grandmother must remove pictures of her grandchildren from her social media accounts after her daughter filed a privacy complaint. The grandmother, according to a Gelderland District Court summary, has not been in contact with her daughter for more than a year due to a family …
We've got Google, Facebook, Palantir and who knows what other companies out there......all hoovering up records of births, marriages, deaths, mortgages, credit card transactions, phone records, browsing histories......and aggregating all these records with "big data" tools.
*
And not only that, we have no idea who these companies are, no idea where the data is stored, and no idea where the processed data is sold on to others.
*
So GDPR and the tacit assumption that the law provides "privacy protection" is just a joke. Articles like this which explicitly tout the privacy concerns of a nice family....are just pure misdirection.
In the UK, it would be possible to obtain a list of all the companies registered for trade, from companies house. You could then write to each and every one and demand they send you what information they have collected on you.
This would mean providing some identifiable information to all these, but I'm not sure how you want this to work... Do you want every company that gets your information to tell you that they have it? Not unreasonable but also sounds like a lot of unwanted Spam. How often should they remind you? How do they contact you if they have your previous address but you've moved?
We could create a central database that's always up to date, which holds all the personal information ever collected on all citizens, then we can be sure it's always up to state - ahem, date - and know what is being held.
As someone who has been doing Information Governance as a gig for the last 20 yrs or so I cannot stress enough that GDPR and Data Protection law historically is not about privacy and it never has been,
Anyone who thinks it is has their head up their backside.
Yes there are privacy aspects but the primary concern is the fair and lawful use of personal information, not privacy.
Personally I think the Dutch court has it wrong, a grandmother posting a picture of her grandchild is personal use - she might have been doing it with the subconscious intention of pi$$ing her daughter off but its nothing other than personal use.
Has she posted the same picture and said 'look at his jumper, I made that, would someone like to buy one' then she is clearly straying away from personal into commercial use.
The problem with Data Protection is the way the laws are written allow for the nuance that is necessary in dealing for the day to day use of information and sometimes it creates daft situations like this.
"She openly published the photo on Facebook. That is a big difference."
Just throwing this out there...I wonder how many facebook photos were posted with the consent of all the people in them? Anyone got the winder for the sluice gate? I think there may be a flood soon.
Is posting anything into a commercial site designed to gather and analyze contents (and you're giving them very broad usage rights on anything you upload), and then monetize that, "personal use"? It's not showing the picture privately to friends on a tablet, especially when the image is accessible publicly. Is actually licensing an image to a commercial third party "personal use"? That doesn't need to imply an exchange of money.
I believe a better definition of "personal use" is needed, because "social" networks have been designed exactly to turn "personal" data into a revenues stream - using them well beyond any personal interest. Especially when other people beyond the user are involved, and no explicit permission was given.
PS: the "the fair and lawful use of personal information" is exactly what a "privacy law" ensures - including when the law forbids the use.
Have you ever been on holiday and thought that a photo of the family would be nice, yet there wasn't a suitable studio nearby to book for a photo shoot? Most people have been in this situation and have decided to just take a photo in public with random people visible in the background. When people do this, it is extremely rare for them to make sure that every single person who is in the background has signed a permission form.
If someone said that those photos are all illegal and should not be shared with friends and family then most people would assume you were using sarcasm to make some political point about the complexity of modern regulations, rather than seriously suggesting that you don't think people should be allowed to take such photos.
If I got a high quality camera with a nice long range zoom lense and went to beeches covertly taking photos of toddlers running around naked, so I could post them on my non-commercial website dedicated to the hobby of photographing naked children... people might be tempted to argue a different interpretation to the regulations.
Both of those scenarios are extremely similar, with the only real difference being the framing of the photo. The first photo has my friends/family in the foreground and the other people are in the background, while the latter is just a generic photo of a beech and I do not know any of the people who might be visible in it.
What point am I trying to make? Well I was trying to show how the real world is not a simple logic operation where you pass 1 or 2 variables to a function that returns a boolean.
To give the only answer to your question that can possibly be correct, yes. Any other answer would require a lengthy list of exceptions and rules, so the only person who can actually give you a valid answer is someone who responds "it is always OK to share otherwise lawful photos that you own the rights to".
If a for-profit news organisation wants to publish an article about the 9 year old girl who builds sophisticated bombs out of recycled parts and sends them to the homes of people who post ignorant nonsense in the comment sections of news websites, it is a bit strange to NOT include a photo of the person the article is about. I think it can be assumed that most parents would not sign a permission form for every news organisation wanting to publish the story... although for the record if TheRegister wanted to write such an article about my daughter then I would give them permission, on the condition that they remove the option to comment anonymously on that specific article. Unfortunately they would probably be able to publish it without my permission and therefore I could only enforce that condition by appealing to their sense of humour.
I concur, it's not fundamentally about "privacy" per se. It's about ensuring that processing does not infringe the human rights of the data subject, of which rights privacy is just one. Unfortunately the law is not (and probably never can be) specific enough to ensure all eventualities are covered for.
On material scope the GDPR states:
" 2.This Regulation does not apply to the processing of personal data: [...] (c) by a natural person in the course of a purely personal or household activity;"
The definition of "purely personal or household activity" is the point at issue here. There's no definitive interpretation and negligible precedent. This case might indeed contribute some provided the opinion is explained properly. Nevertheless, as the legislation is only invoked on the basis of complaints by data subjects, the body of precedent is likely to be slow in accumulating, and in the meantime it's pretty safe for most organisations to ignore the law. That's not so much a fault of the legislation, but of how it's universally enforced.
Births, marriages and deaths are a matter of public record so not quite sure what the issue is with Google using them.
I notice no one bitching about Ancestry.com or the like using exactly the same data in the same way and then charging you for the privilege of accessing them.
I'm no fan of Google but in terms of the use of public records I suspect you are aiming your ire at the wrong target
The thing is that organisations such as Ancestry.com are actually built on the base of decades of work - transcriptions of parish records for example - done by people like my mother, entirely without payment, entirely on the understanding that others would be able to make use of the data, either for free or for a payment to the benefit of one of the local history societies that had organised the work.
Somebody's profiting.
M.
Disregarding the fact that I still not understand the human self image, which makes them believe that it's really indispensable for the whole world to be familiar with their last meal and corresponding defaecation pattern, I'm even more stunned by the asinine thought that FB is some kind of isolated photo album. While the picture was online, FB was crawled over back and forth, preserving grannies (pic) in nooks and crannies. So what are we going to do about that? Will for example Google be subject to the same verdict if the pic pops up there? Didn't we have that same discussion already years ago? Not that that led to ground shuddering changes...
Wrong.
I complain about Facebook privacy invasion. I refuse to use it and yet my details are hoovered up by them.
I post my photographs on a site to which I pay a subscription, and they don't sell the data to other people. They let me decide whether or not to include 'share on facebook' buttons and I don't, because fuck Facebook and their invasive abusive business model.
then you can't piss anyone off. Doh!
Just stop using it for everything. FB is not the answer (42 is naturally). All my family have stopped using it apart from their kids schools who insist on it...
Remember folks, those posts on FB etc could come back to haunt you in later life which could cost you jobs, relationships and even your freedom. The UK does not have statute of limitations unlike the USA. Google, FB and the rest will have all that incriminating evidence on you just waiting for the Warrant from Plod/MI5 etc.
The world is a dangerous place. Don't add to it.
On the other hand, although there's no statute of limitations, historical offences, if prosecuted today, have to work with the law as it was at the time of the offence. So you don't really have to worry if what you did then wasn't an offence at the time.
The woman in question took down all the pictures of the kids except for one of her grandson - whom she looked after for *seven years* ("cared for from April 2012 through April 2019 while the boy and his father, separated from the mother, lived with her"). This is a grotesque misuse of GDPR.
She can still keep the photo in her phone, computer, or photo album, and can share it with her friends & family by showing it to them. Leaving the photo online for the whole world to see is a whole different level of 'sharing'. IANAL but IMO she doesn't have a leg to stand on.
> Leaving the photo online for the whole world to see is a whole different level of 'sharing'.
Missed the nuance of the judgement:
"the case summary says that while GDPR exempts purely personal activity, it's not clear that postings to Facebook, with possible exposure to internet searches, qualify for that exemption."
Basically, the judgement says, post any image to the "Internet", because of the possible exposure to internet searches and you need to have explicit consent...
The only question is what level of precedence this case has set.
".. while GDPR exempts purely personal activity, it's not clear that postings to Facebook, with possible exposure to internet searches, qualify for that exemption."
The GDPR has an extremely long and comprehensive list of recitals which explain how the Regulation is supposed to operate. National courts are supposed to refer to the recitals where they feel the bare words of the Articles are unclear.
Recital 18 says: "This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities." Personally I find the last sentence quite clear. Obviously the Dutch court didn't.
Rough summary of the relevant paragraphs of the court's decision. Please note that I'm not a legal bod.
4.5 GDPR aims to protect the personal information of natural persons. However, GDPR does not cover the processing of personal data by a natural person in the course of a purely personal or domestic activity. Although it is possible that posting a photograph on a personal Facebook page is such an activity the court considers that there is not enough information about how the Facebook or Pinterest accounts are protected. It is also unclear if the photographs can be found by search engines. In relation to Facebook it is possible that the photographs could be distributed, and be held by third parties. Given these circumstances this does not appear to be a purely personal or domestic activity. Hence the provisions of GDPR and the UAVG [Dutch implementation of GDPR] apply to this dispute.
4.6 According to the UAVG, photographs of children under 16 may only posted with the permission of their legal representatives. The parents have not given such permission. Hence the photographs have to be removed. The emotional interest of the grandmother in placing such photographs on social media is insufficient to support another decision.
I think that 4.6 is likely the stronger argument and allone would already be sufficient (it is here in Germany). 4.5 makes everybody jump and scream "because GDPR"!!one!, but the text does make it clear that this is quite a delicate argument being made. I read it as "if you pass on information to commercial entities when you have no business / permission to pass them on to it is BAD". From that argument it might be facebook that is acting against GDPR, not the grandmother (but I am no lawyer, and this contains a lot of wishful thinking ....)
>From that argument it might be Facebook that is acting against GDPR, not the grandmother
Suspect much depends on the agreement between Facebook and its users over Facebook's "non-exclusive, transferable, sub-licensable, royalty-free and worldwide license". [ https://www.facebook.com/terms ]
This could be taken to be a commercial agreement, ie. you the Facebook user are granting Facebook, a commercial entity the right to use your images however they deem fit. Thus because of this condition in the Facebook Terms, it can be argued all content uploaded to Facebook fails the GDPR "purely personal activity" exemption...
The grandmother is the data controller. Facebook is merely a data processor, which acts according to a contract established with the data controller. So it's definitely the grandmother acting against the GDPR from the viewpoint of the legal representatives of the kids.
The data controller/grandmother is then free to sue the data processor/Facebook if she believes they violated the terms of the contract.
I wonder if it matters who took the photo and when. eg might the grandmother have taken the photo when her son and grandson were living with her for 7 years? I don't think that was made clear, but it does seem as if the photo depicted her son and grandson. There's no mention of the daughter in law being in the photo herself, just that she brought the action.
Assuming the grandmother created the photo she retains copyright over the image. As such if she wished to publish said image she is entitled to as she owns the copyright? If all PII was removed from the image metadata would this then pass the GDPR provisions?
"As such if she wished to publish said image she is entitled to as she owns the copyright?"
No. Holding the copyright means you can stop others publishing your work. You can publish work whicih you hold the copyright in, but only if that is not prevented by other legislation.
(If I go and have lunch with my friends at MI13¾ and take a photograph of the 2-year old child of one of them running around the canteen in the altogether then I do hold the copyright in the photograph but cannot publish it for at least three different reasons, even if I remove metadata.)
She can keep the image for her own personal enjoyment. But as it is an image of a minor, she cannot publish it without getting a signed waiver from the minor's guardian(s). It is irrelevant who has copyright, the child is the subject of the photo and therefore permission has to be obtained before publication.
That covers grannies photographing their children, TV cameras in a school (over here, in Germany, they either just film legs running around the playground or they blur out the faces, if the parents haven't signed a waiver for them to be filmed for the TV news), some "Joe" on the street or a professional studio photographer.
It's a more compelling argument than some of the ones on here, but the implication is that permission is not a single transaction, granted and then persisting for all time, but rather something ongoing - you have permission for as long as the granting agency grants permission.
Otherwise we get into the scenario where I can give you permission to borrow my car, which I then sell to some disinterested third party who must continue to allow you to borrow it because I gave permission when I was the legal owner.
It's not about who could have granted permission at the time that the photo was taken, or when the photo was published. It's about who can grant permission right here, right now.
In those 7 years when the child lived with her, the father also lived with them. That strongly suggests that she did not have legal guardianship during that time.
Further, the father did not give consent to have the photo uploaded/shared either.
This is written in the article.
Your face is PII. That's why we have all those failed attempts at facial recognition going around in public places.
So, "if all PII was removed", including blurring the face, then yes, I'm guessing it would pass GDPR provisions.
Now the question is : does Grandma know how to edit the photo and blur the face ?
I'm guessing no.
Considering how easy it is in the US to get registered as a sex offender, it must happen.
"Good afternoon, I'm your children's classmate, I took a stupid naked picture of myself once, and the tough-on-crime DA decided this made me deserve to be registered for life as a sex offender. Can I take pictures of my friends?"
In some states, a man having a pee in public can be enough to get you on the sex offenders register. Why? Because you have exposed your male organ in public. So having a pee up against a tree in the middle of a forest is a potentially life changing envet and not for the good.
No such laws exist for women. Isn't history wonderful.
Another trap is teenage sexuality. Sexting can get you listed on this register -- it doesn't always happen, it depends on where you live, but it can so its a significant risk. Once listed as a sex offender you're never going to get unlisted. Once you're listed you're subject to all sorts of onerous restrictions about where you live with frequent re-registration and criminal sanctions if you miss a deadline. You're also unlikely to find work since the register is public.
We really like to have people to tar and feather over here. Its a cultural thing.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
