GDPR – Photos / Public Place

Personal Data under the GDPR regulations is defined as :

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly.

Therefore a photo quite simply of a person which identifies the person can be included as personal data.

Many times people wonder is taking a photo in public of people ie will this in itself attract the provisions of the data protection laws.

This question or issue is often raised in a school context.

Parents obviously want to take the milestone shots of their little ones.

Generally, one can take the photos but the question then to be asked is what are you going to do with the photos ie social media etc.

Under Article 2 of the GDPR regulation it defines what is Not under the scope of GDPR.

At 2.c it states the Regulation does not apply to :

1. by a natural person in the course of a purely personal or household activity;

This is termed the personal or household activity exemption.

Therefore, if the Mum or Dad has the photos for their own album or just has them on their phones of their kids a school event, the household exemption will likely apply.

When it comes to publishing photos on social medial with other kids present in the photo perhaps the matter is not so straightforward.

If the photos are published on the schools website, then the school won’t be able to rely on the household exemption.

There are 6 different legal bases whereby processing personal data is lawful.

These are  where either:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

There is no exact framework for taking photos at a school event with children, for example.

Commons sense should prevail.

In the Lindqvist case the European Court of Justice held that publishing the data on a website without consent did not qualify for the household exemption.

In the Reynes case the ECJ held that the CCTV data processing did not qualify for the household exemption as it concerned a public place so it was purely personal data capture in essence.

Sharing a private message on facebook etc. with a photo may be covered under the household exemption but placing it in the general feed with a publicly accessible post may not be be covered under the exemption.