AZOP (Croatia) - Decision 18-12-2020

AZOP - Decision of 18 December 2020
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 5(1)(b) GDPR Article 6(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	18.12.2020
Published:	09.08.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Decision of 18 December 2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	Tena

A picture identifying a police officer was posted as a comment on a video of a police operation available in a public Facebook group. The DPA found a violation of Article 5(1)(b) and 6(1) GDPR and ordered the removal of the photo.

English Summary

Facts

A 6 second video of a police officer on a motorcycle was posted on a publicly available Facebook group. While the face of the police officer was not visible in the video, someone published a picture taken when this officer was carrying out his duties, showing his face.

The Border Police then reported the facts to the Croatian DPA, which opened an investigation. The DPA notified the person who posted the picture, as a controller, asking for a clarification on the purpose and legal basis for processing of the officer's personal data.

The controller argued that they obtained the got the picture from Viber group chat and that unwittingly posted it on Facebook.

Holding

The Croatian DPA held that the controller failed to demonstrate a legitimate purpose and legal basis for posting the picture on a publicly available Facebook group. It emphasized that the publication was not related to informing the public of any unlawful conduct from the police officer in the exercise of police power. Rather, the picture was published for the sole purpose of identifying the police officer.

For these reasons, the DPA found a violation of Article 5(1)(b) and Article 6(1) and ordered the controller to delete the photograph, which was still accessible in a public Facebook group.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

1
REPUBLIC OF CROATIA
PERSONAL DATA PROTECTION AGENCY
CLASS:
NUMBER:
Zagreb, December 18, 2020.
Personal Data Protection Agency based on Article 57, paragraph 1 and 58, paragraph 1 and 2 of the Regulation
(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in relation to
with the processing of personal data and on the free movement of such data, as well as on its invalidation
Directive 95/46/EC (General Data Protection Regulation) SL EU L119, and Article 42, paragraphs 1 and 2.
and Article 96 of the General Administrative Procedure Act ("Official Gazette", number: 47/09), and
acting ex officio, makes the following
SOLUTION
1. It is established that the publication of personal data, i.e. a photograph of the police
of officer XX from Police Department X on September 22, 2020 at 11:18 a.m. by X from X
in such a way that X is from X via his user profile X on a public social group
of the Facebook network on the URL link X in his comment that he made on the post under
under the name "X" published a photo of the above-mentioned police officer, it happened
processing of the personal data of the said police officer without a lawful purpose and legal
basis, contrary to Article 5 paragraph 1 point (b) and Article 6 paragraph 1 of the General Protection Regulation
data.
2. X from X is ordered to delete the photo of police officer X from Police Department X
which is still accessible via the URL link X and published without a lawful purpose i
legal grounds contrary to Article 5 paragraph 1 point (b) and Article 6 paragraph 1 of the General Regulation
on data protection.
3. A deadline of 15 days X from X is set for action according to point 2 of the sentence of the Decision and that o
inform the Personal Data Protection Agency of the same within 8 days.
Form layout
The Agency for the Protection of Personal Data (hereinafter: the Agency) received it on September 28
2020 report of Border Police Station X (number: X, dated September 24, 2020 - further in
text: Report) in which it is essentially pointed out that on September 22, 2020, on Facebook
profile of publicly available group “X” available at URL link: X posted video under
2
with the name "X" lasting 6 seconds in which a police officer on a motorcycle was filmed, doc
the police officer's face is not visible. It is further pointed out that X is from X (hereinafter: X) via
own Facebook profile X posted a comment on the above video in such a way that
published a photo of a police officer of the Police Department X X (hereinafter: police
officer) during the time when the said police officer performed his official duty without
existence of public interest in publishing the photograph.
For the purpose of accurate and complete determination of the factual situation and enabling the opposite party
(X) to present his statement regarding the relevant publication of the photo of the police officer on
own Facebook profile, the Agency requested in a letter on October 27, 2020
statement X in accordance with Article 51 of the Act on General Administrative Procedure, and regarding the circumstances from
Reports, which refer to the publication of a photo of a police officer, and in particular it is
requested statement on the legal purpose and legal basis from Articles 5 and 6 of the General Regulation on Protection
data based on which the above photo was published in a public social group
of the Facebook network under the name: X".
On November 9, 2020, the Agency received the requested declaration X in which it expires
how he obtained the photo of the police officer in question from a group on Viber and how it is
unknowingly put her in the "X" group, and how he apologizes for what he did.
Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals
in connection with the processing of personal data and the free movement of such data and the placement
out of force of Directive 95/46/EC (General Data Protection Regulation) SL EU L119 in its entirety
binding and directly applicable and entered into force on May 25, 2018, for the application of which
and implementation on the territory of the Republic of Croatia is the competent Agency for Personal Protection
data.
The General Data Protection Regulation applies to the processing of personal data in its entirety
performs automated and non-automated processing of personal data that are part of the system
storage or are intended to be part of the storage system (Article 2 of the General Data Protection Regulation).
Personal data is all data relating to an individual whose identity has been or can be determined
determine, and an individual whose identity can be determined is a person who can be identified directly
or indirectly, especially with the help of identifiers such as name, identification number, information about
location, network identifier or with the help of one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that individual (Article
4.1. General regulations on data protection).
Personal data must be processed legally, fairly and transparently with regard to the subject,
collected for specific, express and lawful purposes, appropriate, relevant and limited to what
is necessary in relation to the purposes for which they are processed (principle of reducing the amount of data), accurate and
as necessary, up-to-date, processed in a way that ensures adequate personal security
data, including protection against unauthorized or illegal processing and against accidental loss,
destruction or damage by applying appropriate technical or organizational measures (principle
integrity and confidentiality) (Article 5 of the General Data Protection Regulation).
3
The processing of personal data is legal only if and to the extent that the minimum is met
one of the following: the respondent has given his consent to the processing of his personal data in one or more
special purposes; processing is necessary for the execution of a contract in which the respondent is a party or how
actions would be taken at the request of the respondent before the conclusion of the contract; processing is necessary for
compliance with the legal obligations of the controller; processing is necessary to protect key interests
legal obligations of the controller; processing is necessary for the performance of a task of public interest or
when exercising the official authority of the data controller; processing is necessary for legitimate interests
data controller or third party (Article 6 of the General Data Protection Regulation).
We also highlight the application of a special regulation, more specifically Article 2, Paragraph 1, Point 3 of the Law
on police duties and powers ("Official Gazette" no. 76/09, 92/14 and 70/19) in which
it is prescribed that a police officer of the Ministry of Internal Affairs is also an officer of a party
of the police service, which is authorized according to the international agreement, this and other laws
perform police duties, applying police powers.
In Article 9, Paragraph 3 of the Law on Civil Servants ("Official Gazette" No. 92/2005,
140/2005, 142/2006, 77/2007, 107/2007, 27/2008, 34/2011, 49/2011, 150/2011, 34/2012,
38/2013, 37/2013, 1/2015, 138/2015, 102/2015, 61/2017, 70/2019 and 98/2019) it is prescribed that
civil servants have the right to the protection of physical and moral integrity during their work
official duties.
In this administrative matter, it was established that X is through his own Facebook profile, which is accessible
on URL link X on September 22, 2020 at 11:18 a.m. in a publicly accessible Facebook group
named “X” available at the URL link X posted a comment on the post named “X”
in which he published a photo of police officer X while on duty
duties, and which photo is still publicly available via URL link: X to all
to users of the social network Facebook.
Considering that in his statement, X briefly referred to how he had unknowingly published the dispute
photo of a police officer in a publicly available Facebook group called "X" and how
apologizes for the aforementioned publication of the photo, X has not proven the existence of a legal basis for
the processing of personal data of a police officer, i.e. for the publication of a photograph through which
can clearly establish the identity of a police officer in the sense of Article 4, Paragraph 1, Point 1. General
regulations on data protection. Moreover, X did not refer to the legitimate purpose and legal basis of the publication
personal data of a police officer, and from which it is clear that at disposal
with the personal data of the police officer (publication of the photo of the police officer) is not
took into account the need to comply with Articles 5 and 6 of the General Data Protection Regulation, i.e
legal obligations that when processing the personal data of the respondent (here a police officer)
it must always have a special, explicit and lawful purpose and legal basis.
In this administrative matter, it was not determined that the subject publication of the photo would be related to
informing the public about the possible illegal behavior of a police officer on the occasion
of the application of police powers towards citizens, it has already been published for the purpose of making it clear
identification of the police officer following his stop at the bus station in
4
moment while he was performing his duties on a police motorcycle and how it stems from various factors
comments that were published by Facebook users due to the dissatisfaction of residents of X
as a result of the allegedly too rigorous punishment of participants in public transport by the person in question
of the police officer and the ongoing stop of the police officer at the bus station
driving an official police motorbike. Since from the above posted video
it is not possible to unequivocally establish the identity of the police officer, X is as given
concluded decided to publish a photo of the police officer in question in which it is possible
to establish the identity of the police officer in an unambiguous way so that all social users
network Facebook knew exactly which police officer it was. Namely, on the disputed one
the photo shows a police officer in the course of exercising his official powers, and on which
also finds an unknown citizen searching a laptop on a bench in a public square
on the surface, and from the photo in question, it is not clear possible illegal actions of the police
official. From all of the above, it is clear that the publication of the disputed photo by X was not
had as its sole aim (purpose) the disclosure of information to the public, which would indicate possible
clearly illegal behavior of a police officer. Absence of lawful purpose and legal
the basis from Articles 5 and 6 of the General Regulation on Data Protection is primarily evident from the
X's statement in which he states that he unknowingly published the disputed photo of the police officer
official and that he apologizes for the aforementioned publication and did not refer to in any part
possible becoming a legitimate purpose and legal basis from Article 5 and 6 of the General Regulation on Protection
data, although the Agency explicitly stated this in its letter requesting a statement from X
emphasized.
Since X did not prove the existence of a legitimate purpose and legal basis for the publication of the photograph
of a police officer in a publicly available group on the social network Facebook called
"X", the described action resulted in a violation of Article 5, paragraph 1, point (b) and Article 6, paragraph
1. General regulations on data protection.
Considering the fact that the photo in question is still publicly available via URL
links X to all users of the social network Facebook had to be ordered by Decision
removal of photo of police officer. In accordance with everything stated, it was decided as in
Say the solutions.
LEGAL REMEDY
No appeal is allowed against this decision, but an administrative dispute can be initiated before the Administrative Court
by the court within 30 days from the date of delivery of the decision.
 DEPUTY DIRECTOR
 Igor Vulje, B.Sc. Crimea.


Deliver:
1. X
2. Stationery, here
5
Note:
1. Police Department X, Border Police Station X