Persónuvernd (Island) - 2021091877

Persónuvernd - 2021091877
[[File:|center|250px]]
Authority:	Persónuvernd (Island)
Jurisdiction:	Iceland
Relevant Law:	Article 6 GDPR Article 6(1)(f) GDPR Article 58(2)(f) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	24.09.2021
Decided:	14.12.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	2021091877
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	personuvernd.is (in IS)
Initial Contributor:	co

The Icelandic DPA ordered a controller to remove a post from a social media platform which constituted processing in violation of Article 6(1)(f) GDPR.

English Summary

Facts

A Facebook user, as a controller, published photos and police reports that are part of an investigation file of a criminal case, including sensitive data about a data subject, in a Facebook post on his profile in which he gave his opinion on the case.

The data subject, who is a victim or witness in the criminal case, felt that her right to privacy had been violated and thus filed a complaint with the Icelandic DPA.

In his submissions, the controller stated that he did not process personal data of the data subject because he merely expressed his opinion on the case which is covered by the fundamental freedom of expression as a citizen.

Holding

First of all, the Icelandic DPA made a preliminary remark.

On the one hand, it considered that it generally has no competence to decide on cases relating to freedom of expression, hence it could not take a stance on the text of the post itself, as it constitutes the controller's expression of his opinion. According to the DPA, it is up to courts to assess the scope of such freedom and balance it against the right to data protection under the Icelandic constitution and Article 10 ECHR.

On the other hand, however, the DPA considered itself competent to decide on the processing of personal data by the controller.

After stating that the GDPR applies, since the post is accessible to all Facebook users, and did not constitute processing for private purposes, the DPA considered that the user was also a controller under Article 4(7) GDPR. The DPA clarified that the police files were meant to be kept secret and it could not ascertain how the controller got hold of the documents as it was unrelated to the criminal case.

The DPA went on to assess the legality of processing under Article 6(1)(f) GDPR and carried out a balancing exercise between the interests at stake. The DPA considered that, since the controller is neither a party to the criminal investigation, nor should he have accessed the police files, it could not be held that his interests in disclosing such information could outweigh those of the data subject.

Hence, the DPA held that the controller aced contrary to Article 6 GDPR and ordered him, under Article 58(2)(f) GDPR, to remove the post from his profile within a month from the decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Publishing a text post along with photos from police files on a person's Facebook page

Case no. 2021091877

21.12.2023

Personal protection is generally not competent to take a position on whether expression is protected by law, but the assessment of that is up to the courts. However, in certain cases, Personal Protection may deal with the publication of information from data of any kind or databases that contain personal information.

----

Data protection ruled in a case where a complaint was made about the publication of a text post together with photographs of case documents in a criminal case on a person's Facebook page. The Data Protection Authority's conclusion was that the text entry had included the controller's expression of his views and convictions, which the Data Protection Authority was not competent to take a position on, as it was up to the courts to decide whether that expression was protected by Article 73. Constitution of the Republic of Iceland, no. 33/1944 and Article 10 European Convention on Human Rights. On the other hand, the Personal Protection Authority considered that in the case of publication or other processing of information that could be verified objectively, such as by looking up records or other similar means, it was processing of personal information that the organization was competent to rule on . Regarding the publication of the photos from the police files, which i.a. contained sensitive personal information about the complainant, it was the conclusion of the Data Protection Authority that the interests of the responsible party, which was irrelevant to the investigation of the criminal case by the police, did not outweigh the interests of the complainant that the information would not be published. The publication of the photos from the police files was therefore considered not to have been in accordance with the law.

Ruling

On December 14, 2023, the Board of Personal Protection made the following decision in case no. 2021091877:

i

Procedure

1.

Outline of a case

On September 24, 2021, Personal Protection received a complaint from [A] (hereinafter the complainant), about the publication of [B], on a post on his Facebook page on 5 a.m., along with five photos. Three of the photos are from police files and show information from police reports, which belong to the investigation files of a criminal case where the complainant had either the status of a victim or a witness; letter from the complainant and other victims to the police about the withdrawal of the complaint, and their request for the cancellation of the investigation. The police reports include, among other things, sensitive personal information about the complainant.

By letter, dated On August 8, 2022, [B] was invited to comment on the complaint and his answers were received on the 31st s.m. The complainant was then given the opportunity to submit comments to [B]'s answers by letter, dated 22 September s.á., and they were received by e-mail on 3 October s.á. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

The processing of the case has been delayed due to the heavy workload at Personal Protection.

2.

Complainant's point of view

The complainant relies on the fact that by publishing [B]'s post, together with the said photos from the police files, on his Facebook page, he has violated the Privacy Act. The case pertains to his expression along with the publication of files from the police database that contain very sensitive personal information about the complainant. It is an illegal attack against the reputation and character of the complainant. The publication of the post had the sole purpose of being an attempt to humiliate her and mislead the public by reducing her credibility and implying that she lied about the progress of a criminal case that was under investigation. The complainant does not know how [B], who is irrelevant to the case, got hold of the data in question, but he should not have had it in his hands, reviewed it or published it publicly.

3.

point of view [B]

[B] is based on the fact that, with his post and the publication of the photos, he did not work with the complainant's personal information, but only exercised his constitutionally protected right to speak about issues that the complainant himself had publicly highlighted and concerned [...] ]. By taking part in a public debate, correcting the complainant's misrepresentations and telling the truth supported by data, he is not working with personal data in the sense of the law under which the Data Protection Authority operates. Then he did not express himself as [...] in that case, but as a citizen. [B]'s position is that there was no processing of the complainant's personal information and that the publication in question falls under his constitutionally protected right to expression as a citizen and therefore outside the scope of the Act on Personal Protection and Processing of Personal Information.

II.

Assumptions and conclusion

1.

Scope

Scope of law no. 90/2018, on personal protection and processing of personal information, and regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thus the authority of Personal Protection, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or fully automated and the processing of personal data that is or is to become part of a file by methods other than automatic.

Personal information is information about an identified or identifiable person, and a person is considered identifiable if it is possible to identify him, directly or indirectly, with reference to his identity or one or more factors that are characteristic of him, cf. Number 2. Article 3 of the Act and number 1 Article 4 of the regulation.

According to paragraph 2 Article 4 Act no. 90/2018, they and Regulation (EU) 2016/679 do not apply to an individual's processing of personal information that only concerns his or his family's private interests or is solely intended for personal use. In Article 18 the preamble of the regulation states, among other things, that processing that is only for the benefit of an individual or his family can e.g. included for the use of social media and Internet use that takes place in connection with such processing. In cases when personal data, including photographs, are published on closed accounts of social media users, such publication may be considered to fall outside the scope of the law and regulation. Does this generally mean accounts that are closed to the public and are only visible to those connected to the person in question. From the documents of the case, as well as from the observation of the Personal Protection Agency, it is clear that the post and data complained about were accessible to all logged-in Facebook users. Accordingly, and taking into account the above-mentioned provisions, this case concerns the processing of personal data that falls within the scope of Act no. 90/2018.

The person responsible for the processing of personal information is compatible with Act no. 90/2018 is the named responsible party. According to number 6 Article 3 of the Act, it refers to an individual, legal entity, government or other entity that alone or in cooperation with others determines the purposes and methods of processing personal data, cf. Number 7. Article 4 of the regulation. As stated here, [B] is considered to be the party responsible for the processing in question.

2.

The relationship between privacy and freedom of expression

As is the case here, the significance of the fact that the processing of personal data complained about includes expression is protected by Article 73. Constitution of the Republic of Iceland, no. 33/1944, cf. also Article 10 European Convention on Human Rights.

In paragraph 1 Article 73 of the constitution says that everyone is free of their opinions and convictions, and in paragraph 2. the same article says that every person has the right to express his thoughts, but that he must vouch for them in court. It also says in paragraph 1. Article 10 European Convention on Human Rights that everyone has the right to freedom of expression. That right shall also include the freedom to hold opinions, receive and pass on information and ideas at home and abroad without government interference.

When a party uses its freedom to express its opinions and convictions according to the above, as well as value judgments about individuals based on the facts, Personal Protection has considered that the organization is not competent to assess whether a party has gone beyond constitutional protection his freedom of expression in relation to the privacy of a protected person according to Article 71. of the Constitution and Article 8 of the human rights convention and thus backed by law. Since people's opinions or ideas about individuals are not considered personal information about the latter in the sense of item 2. Article 3 Act no. 90/2018, disputes about that do not fall under the scope of the law, but it is up to the courts to decide where the boundaries lie between the constitutionally protected rights in each case.

As mentioned above, the complaint that is being resolved here concerns, on the one hand, the publication of a text entry that describes the opinions, thoughts or attitudes of the responsible party to the complainant, as well as the sharing of images from police files, i.e. police reports and letters containing, among other things, sensitive personal information about the complainant. The responsible party published the data in question alongside a text post on his Facebook page, where he commented on his views on the complainant, her statements in the media about the content of the criminal case as well as her text posts on social media. It is clear that the text of the post itself constitutes the responsible person's expression of his views and convictions. The text also implies that the responsible party has published the aforementioned photos to support the claims made there. On the other hand, it will not be ignored that the mentioned photos from the police files, i.e. from a police report and letters to the office, contain information about a criminal case that was under investigation by the police and it was natural to keep it secret in view of public and private interests. It is known that some discussion had been created in the community due to the complainant's complaint which led to the investigation and the media had covered the case. It is unclear how the responsible party, who was unrelated to the criminal case in question, got hold of the police reports and letters.

Personal data protection has considered that when it comes to publication or other processing of information that can be verified objectively, such as by looking up records or other similar means, it is processing of personal information that the organization is competent to decide on. In such cases, it falls under the authority of the Data Protection Authority to decide whether the processing is compatible with Act no. 90/2018 and regulation (EU) 2016/679, cf. ruling of the institution, dated August 27, 2020, in cases no. 2020010550 and 2020010610. The police files in question, of which the responsible party published a photo on their Facebook page, contain personal information about the complainant that the Personal Protection Authority is competent to deal with on the basis of Act no. 90/2018.

Personal protection has issued an opinion, dated January 26, 2022, in case no. 2021091863 on personal protection and expression of individuals on the Internet. It states, among other things, that when photographs of data are published alongside a text entry, the context of the entry and the data must be assessed, but it can also be important what the relationship of the person who publishes the data or information from it is to the matter to which the information relates. Thus, it is more likely that an individual's publication of data concerning himself would be considered to include expression than if he has no direct connection with the subject of the data, as people must be allowed a certain amount of scope to discuss their own lives without government interference. If an accompanying document with an entry is from the person who wrote it, it may be considered to include his expression in the same way as the entry, at least partly cf. ruling, dated August 27, 2020 in case no. 2001010610.

3.

Lawfulness of processing

All processing of personal data must be covered by one of the authorized provisions of Article 9. Act no. 90/2018, cf. Paragraph 1 Article 6 of regulation (EU) 2016/679. For example, personal data may be processed if the processing is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh, cf. Number 6. of the legal provision and section f of the regulatory provision.

In addition to authorization according to the above, the processing of personal data must satisfy all the principles of paragraph 1. Article 8 Act no. 90/2018, cf. Paragraph 1 Article 5 of regulation (EU) 2016/679. Among other things, it is stipulated that personal data must be processed in a lawful, fair and transparent manner towards the data subject, cf. Number 1. of the legal provision and point a of the regulatory provision, that they must be obtained for a clearly specified, legitimate and relevant purpose and not further processed for other and incompatible purposes, cf. Number 2. of the legal provision and point b of the regulatory provision, and that they must be sufficient, appropriate and not beyond what is necessary based on the purpose of the processing, cf. Number 3. of the legal provision and point c of the regulatory provision.

As is the case here, the publication of personal information in question could not rely on sources other than section 6. Article 9 Act no. 90/2018, cf. point f, paragraph 1 Article 6 of regulation (EU) 2016/679. From the wording of the provision, it is clear that before processing takes place on its basis, a certain interest assessment must be carried out. It is clear from the documents of the case that the party responsible for the processing was not involved in the said criminal case or its investigation. In the responsible party's answers, it is stated that he, as a citizen of the country, was using his constitutionally protected right to tell the truth in an open discussion about the criminal case. It is also to be considered that the police data in question is not public information or part of the data to which the public generally has a right of access, in addition to which the complainant objected to the publication. It is the opinion of the Data Protection Authority that, as is the case here, it cannot be considered that the interests that may have called for the disclosure of data and information about the complainant, in the opinion of the responsible party, outweighed the interests of the complainant because the information would not published.

In view of the above, the conclusion of the Personal Protection Authority is that the processing [B] of the complainant's personal information, which consisted in the publication of images from police files, including police reports and letters, did not comply with Act no. 90/2018, on personal protection and processing of personal information.

In accordance with this conclusion, and with reference to item 6. Article 42 Act no. 90/2018, cf. point f, paragraph 2 Article 58 Regulation (EU) 2016/679, it is hereby proposed to [B] to remove from his Facebook page images of police documents and letters related to the investigation of a criminal case to which the complainant was a party, specifically in posts published on September 5, 2021 Confirmation that these instructions have been complied with must be received by Personal Protection no later than January 15, 2024.

Ruling:

The aspect of [A]'s complaint is referred to [B]'s text post about it on his Facebook page.

The publication of [B], on his Facebook page, of photographs of police reports and letters, which contained [A]'s personal information, did not comply with the provisions of Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679.

In accordance with this conclusion, and with reference to item 6. Article 42 Act no. 90/2018, cf. point f, paragraph 2 Article 58 Regulation (EU) 2016/679, the person responsible for the processing is hereby asked to remove from their Facebook page images of police data and letters related to the investigation of a criminal case to which the complainant was a party, specifically in posts published on September 5, 2021. Confirmation that these instructions have been complied with must be received by Personal Protection no later than January 15, 2024.

Privacy, December 14, 2023

Ólafur Garðarsson
chairman

Árnína Steinunn Kristjánsdóttir Björn Geirsson

Vilhelmína Haraldsdóttir