AZOP (Croatia) - Decision 10-08-2023

AZOP - Decision of 10 August 2023
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 5 GDPR Article 6 GDPR Article 8 Media Act
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	10.08.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Decision of 10 August 2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	co

The Croatian DPA held that a media outlet unlawfully processed personal data of a data subject as the data was not publicly available and the public interest did not prevail over the right to privacy of the data subject.

English Summary

Facts

A data subject found that a media outlet, the controller had published an article on its website and on its Facebook page including personal data about her, more specifically pictures of her legs. The pictures in question were posted by the data subject on her private Facebook profile, hence they were not meant to be seen by the public at large.

The data subject believed this processing to be unlawful and filed a complaint with the Croatian DPA (AZOP) against the controller.

In its submissions, the controller stated that it mentioned the data subject in its article, among with other people and that it was not the first time that the data subject was featured in one of their articles, as she was a prominent member of a political party. Further, the controller claimed that the photos in question were public as the data subject herself had publish them on social media.

Holding

The AZOP took into account all the facts and the relevant GDPR articles, as well as provisions of the Croatian Media Act on media freedom and freedom of expression.

In particular, the AZOP recognised that Article 8 of the Media Act stipulates that there cannot be a violation of the right to data protection if there is a prevailing public interest in relation to journalistic activities. In this regard, the AZOP held that the Media Act represents the legal basis for processing of personal data by the controller as a media outlet in order to achieve the purposes established by that law. However, the AZOP stated that in this case the controller failed to provide a legal basis for processing the pictures of the data subject. Effectively, the controller could not rely on the fact that the data subject was a member of a political party to justify the publication of pictures of her which are unrelated to her political activities. In this the AZOP held that the controller acted contrary to Article 5(1)(a) GDPR and Article 6 GDPR.

Moreover, the AZOP reiterated the fact that the pictures were only available on the private Facebook account of the data subject and should not have been available to third parties. In this respect, the AZOP held that notwithstanding the application of the Media Act and the importance of freedom of expression, media outlets and journalists are still obliged to respect the privacy, dignity and reputation of individuals.

Further, since the contested Article was still accessible online, the AZOP ordered the controller to delete the unlawfully published personal data about the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

1
REPUBLIC OF CROATIA
PROTECTION AGENCY
PERSONAL DATA
CLASS:
NUMBER:
Zagreb, August 10, 2023.
Personal Data Protection Agency, OIB: 28454963989 on the basis of Article 57 paragraph 1 and
of Article 58, Paragraphs 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27
2016 on the protection of individuals in connection with the processing of personal data and on the free movement of such data
data and repealing Directive 95/46/EC (hereinafter referred to as the General Protection Regulation
data) SL EU 119, Article 34 of the Law on the Implementation of the General Regulation on Data Protection ("People's
newspaper" No. 42/2018) and Articles 41 and 96 of the Law on General Administrative Procedure ("National
newspaper" No. 47/09 and 110/21), and regarding the request to determine the violation of the right to protection
personal data X provides the following
SOLUTION
1. The request for determining the violation of the right to the protection of personal data of the applicant X is
established.
2. It is established that the public publication of the article under the title "X?" (link: X) which contains
X's personal data, specifically her two photos, on the X portal and on the Facebook page
of the same, company X published the applicant's personal data without
the existence of a lawful purpose and legal basis from Articles 5 and 6 of the General Regulation on Protection
data.
3. Company X, as the processing manager, is ordered to remove/delete the applicant's photos
requests published in the article entitled "X?" on the X portal which were published without
the existence of a lawful purpose and legal basis from Articles 5 and 6 of the General Regulation on Protection
data within 8 days from the date of receipt of this decision.
4. A deadline of 8 days from the day of receipt of this is set for company X as the processing manager
decision to inform the Protection Agency about the action according to point 3 of the sentence of this decision
personal data.
Form layout
2
The Agency for the Protection of Personal Data (hereinafter: the Agency) received a request for
establishing a violation of the right to the protection of personal data X (hereinafter: the applicant
request) in which it states that it was given on March 14, 2023 on the Internet
X and an article titled "X" was published on the X Facebook pages in which they were published
her personal information. More precisely, the article in question states, among other things, "Vitkim
the former also likes to brag about her legs..." and the applicant's photo was published.
The applicant further states that the photo in question is on her private Facebook
profile and can only be accessed by registered users and only those who are "her friends",
that is, it did not arise in connection with her public engagement. In conclusion, the applicant states
as she did not give her consent for the said publication.
The request is founded.
Furthermore, in accordance with its legal powers, the Agency requested X as a manager
process the statement on the allegations from the received request, that is, to clarify for what purpose i
based on which legal basis in terms of Articles 5 and 6 of the General Data Protection Regulation are
published personal data of the applicant, specifically her photos.
As requested, the company in question responded by confirming that it is on the portal
X on the Facebook page on the same day, March 14, 2023, the article "X?" was published in which
several persons were mentioned, including X. In particular, the company states that X is mentioned
in one sentence that reads: "The ex likes to brag about her slender legs..." and are in addition to the above
two photos taken from her Facebook profile were also published. Society further
states that X has been written about on the X portal several times and that she is a prominent political member
of the party, in charge of communication with the media, i.e. the president X was the same.
In conclusion, company X, as the processing manager, states that the applicant is the photograph that they are
published in the article in question, she herself published them on a social network and did so
available to the public.
Additionally, taking into account the statements from the received request, the Agency on 07.
in August 2023, carried out supervision, i.e. checking whether the photos are of the applicant
requests are still publicly available/published on portal X and on its Facebook page. With that in
connection, it was determined that the article under the title "X" on the X portal still contained two
photographs of the applicant. Likewise, it was established that the article in question no longer exists
available on the Facebook page of portal X, i.e. there are no posts from the period of 06
September 2022 to May 13, 2023.
First of all, it should be noted that from May 25, 2018, in the Republic of
In Croatia, Regulation (EU) 2016/679 of the European Parliament and the Council of 27
of April 2016 on the protection of individuals in connection with the processing of personal data and on free movement
such data and on the repeal of Directive 95/46/EC (General Protection Regulation
data) SL EU L119.
3
The General Data Protection Regulation in Article 4, Paragraph 1, Point 1 stipulates that they are personal
data all data relating to an individual whose identity has been determined or can be determined, a
an individual whose identity can be established is a person who can be identified directly or
indirectly, especially with the help of identifiers such as name, identification number, information about
location, network identifier or with the help of one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that individual.
Pursuant to Article 5 of the General Data Protection Regulation, personal data must be: (a)
lawfully, fairly and transparently processed with respect to the data subject ("lawfulness, fairness,
transparency"); (b) collected for specific, express and lawful purposes and may not be further
process in a way that is inconsistent with those purposes ("purpose limitation"); (c) appropriate,
relevant and limited to what is necessary in relation to the purposes for which they are processed ("reduction
amount of data"); (d) accurate and as necessary up-to-date; every reasonable measure must be taken
in order to ensure that personal data that are not accurate, taking into account the purposes for which
process, delete or correct without delay ("accuracy"); (e) stored in a form that enables
identification of the respondent only for as long as is necessary for the purposes for which it is personal
data processing ("storage limitation"); (f) processed in the manner in which it is secured
adequate security of personal data, including protection against unauthorized or illegal access
processing and from accidental loss, destruction or damage by applying appropriate technical or
organizational measures ("integrity and confidentiality").
Pursuant to Article 6 of the General Data Protection Regulation, processing is lawful only if and in that
to the extent that at least one of the following is met: (a) the subject has given consent for processing
your personal data for one or more special purposes; (b) processing is necessary for performance
contract to which the respondent is a party or to take actions at the request of the respondent before
conclusion of contracts; (c) the processing is necessary to comply with the legal obligations of the controller; (d)
processing is necessary to protect the key interests of the data subject or other natural person; (e) processing
is necessary for the performance of a task of public interest or for the performance of the manager's official authority
processing; (f) the processing is necessary for the purposes of the legitimate interests of the controller or a third party, except
when these interests are stronger than the interests or fundamental rights and freedoms of the respondents that require protection
personal data, especially if the respondent is a child.
In the specific case, the Media Act ("Official Gazette", number: 59/04,
84/15, 81/13 and 114/22) as a special law, which, among other things, regulates the prerequisites for
realization of the principles of media freedom, the rights of journalists and other participants in public information
on freedom of reporting and availability of public information, rights and obligations of publishers,
exercising the right to correction and response, etc.
Likewise, in Article 3 of the cited Law, it is stated that freedom of expression is guaranteed and
media freedom, which includes, among other things, freedom of expression, independence
media, freedom to collect, research, publish and distribute information in the aim
public information, availability of public information and respect for human protection
personality, privacy and dignity.
4
Also, Article 7 of the Law on Media stipulates that every person has the right to
protection of privacy, dignity, reputation and honor.
There is no violation of the right to privacy if it prevails in terms of information
justified public interest over the protection of privacy in relation to the activities of journalists or to
information (Article 8 of the Media Act).
Following the above, in the conducted procedure based on established facts i
of the collected evidence in this administrative matter, it was established that company X is public on portal X
published an article entitled "X?" which, among other things, contains the personal data of the applicant
request/ her two photos.
Therefore, in the specific case, it was determined that the publication of the applicant's photos in
to the article in question represents illegal processing of the applicant's personal data.
In this regard, we point out that the above-mentioned special law, the Media Act, represents
legal basis for processing personal data in accordance with Article 6 of the General Data Protection Regulation.
Therefore, company X as a media has the right to publish the information it may contain
personal data to the extent that is relevant/necessary to achieve the purpose established by law.
However, in the specific case, company X, as a data controller, did not prove that it was for publication
photo of the applicant mentioned in the article entitled "X?", there is one
from the legal grounds from Article 6 of the General Data Protection Regulation. At the same time, by publishing photos
of the applicant, the data controller in question also acted contrary to Article 5 of the General Regulation
on data protection.
Namely, company X stated in its statement that it had written about the applicant several times
demands and that she is a prominent member of a political party, in charge of communication with
to the media, that is, as President X was. However, it should be pointed out that
the mentioned statements cannot be taken as relevant for the specific situation, considering that
the disputed article under the title "X?" does not refer to the activity of a political party, that is, it is not done
about giving a statement to the media, nor does it concern the applicant's activities as president
X. Therefore, referring company X to some previous publications/processing of personal data
of the applicant, cannot constitute a legal basis for the processing/publication of her data
photo in the disputed article.
Likewise, company X, as the processing manager, states that the applicant is the photo which
were published in the article in question, she herself published them on the social network and did so
available to the public, however, the subject matter also cannot represent a legal basis for
processing/publication of her personal data in the disputed article. At the same time, it is necessary to take u
the applicant notes that the photos in question are on her private Facebook
profile and can only be accessed by registered users and only those who are "her friends",
therefore, they were not freely available to third parties.
5
In this regard, it is necessary to point out that the processing manager at each processing (publication)
of personal data should take into account the purpose of processing (publication) of personal data, i.e. whether
is the processing (publication) of personal data justified (legal) and whether there is a legal basis for
processing (publication) of personal data, while respecting the need for justified public
interest in the publication of information related to the privacy of respondents.
Also, when personal information is published on the Internet, personal information is available
the general public therefore needs to take into account the purpose and scope of the data that is published
to protect the privacy of respondents and prevent possible misuse of personal data.
As a result of the above, in this administrative matter it was established that company X failed
prove the legal basis from Article 6 of the General Data Protection Regulation for the publication of photographs
of the applicant in article "X?", and by the publication of the applicant's personal data
of the request, there was also a violation of the principles of processing from Article 5 of the General Regulation on Data Protection, s
given that they were not processed legally and fairly.
Regardless of whether a special law applies in a specific case, the media are obliged
respect the privacy, dignity, reputation and honor of citizens. Also, the Croatian Code of Honor
of a journalist obliges the journalist to, among other things, protect a person's intimacy from sensationalism
and any other unjustified disclosure in public, to respect everyone's right to privacy.
In conclusion, considering that in the conducted procedure it was established that personal data
of the applicant are still publicly available/published on portal X in the article under the title
"X?", it was necessary to instruct the data controller in question to delete/remove personal data
data of the applicant that were published without the existence of a lawful purpose from Article 5.
and the legal basis from Article 6 of the General Data Protection Regulation. Likewise, given that it is
subsequent checks established that the applicant's personal data are no longer public
available on the Facebook page of portal X, the Agency has no reason to impose further measures
to the data controller for the removal of disputed personal data on the Facebook page in question
portal X
Due to the aforementioned circumstances, it was decided as in the Proclamation of the Decision.
LEGAL REMEDY
No appeal is allowed against this decision, but an administrative dispute can be initiated before
by the Administrative Court in X within 30 days from the date of delivery of the decision.
DEPUTY DIRECTOR
Igor Vulje
6
Deliver:
1. X
2. X
3. Stationery, here.