IDPC (Malta) - CDP/COMP/429/2023
From GDPRhub
| IDPC - CDP/COMP/429/2023 | |
|---|---|
 | |
| Authority: | IDPC (Malta) |
| Jurisdiction: | Malta |
| Relevant Law: | Article 2(2)(c) GDPR Article 6(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 17.03.2023 |
| Decided: | 25.07.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | CDP/COMP/429/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Maltese |
| Original Source: | IDPC (in MT) |
| Initial Contributor: | Alex Smith |
The Maltese DPA held that if data is processed beyond personal or household activities, the exemption under Article 2(2)(c) GDPR does not apply.
English Summary
Facts
On the 17th March 2023 the data subject lodged a complaint. An individual (the controller) had taken photographs of the data subject's home from their own home as part of a legal claim. In the photos the data subject and their child appeared in the background. These photos, due to being part of a legal claim, were sent to the Review Tribunal of Environment and Planning.
The controller argued that the photographs were not processed in connection to a professional or commercial activity and that therefore the exemption under Article 2(2)(c) GDPR applied. They also argued that the photos themselves were so grainy that the data subject could not be identified and that the data was not easily public as one would have to go personally to the Tribunal to view the photos.
Holding
First, The DPA noted that the household exemption under Article 2(2)(c) GDPR must be interpreted strictly as per CJEU case law and EDPB guidelines. Processing cannot be considered purely personal when the personal data becomes accessible to an indefinite number of persons, or when this activity extends, even if partially, to the public domain. As the personal data was used for a legal claim the household exemption under Article 2(2)(c) GDPR could not apply.
Second, the DPA considered that the definition of personal data under Article 4(1) GDPR refers to any 'identifiable person.' The DPA examined the photos and determined that the data subject and their child could be recognised from the photos and were therefore, identifiable. The DPA also considered that one of the individuals was a minor which required special protection under recitals 38 and 75 GDPR.
Third, while it is true that the records of the Review Tribunal of Environment and Planning are not available online, the records are nonetheless publicly available. Any number of people could view the photographs within the Review Tribunal of Environment and Planning's records.
As the exemption did not apply, the data controller was processing personal information without a lawful basis, which is required under Article 6(1) GDPR. The DPA therefore issued the data controller with a reprimand under Article 58(2)(b) GDPR for unlawful processing of personal data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Maltese original. Please refer to the Maltese original for more details.
On 17 March 2023, Mrs (the "complainant" or the "data subject"), lodged a complaint with the Commissioner for Information and 1-Data Protection (the "Commissioner") ai terms of article 77(1) of the General Regulation on Data Protection' (the "Regulation"), claims that
took photos of the complainants and other individuals, including minors, while they were in her residence, and subsequently attached these photos to an affidavit which was eventually presented to the Review Tribunal
of Environment and Planning.
THE INVESTIGATION The Submissions of |
2. According to article 58(1)(a) of the Regulation, the Commissioner provided to
a copy of the complaint, including the documentation attached to it, he was asked to submit his submissions in order to defend himself from the allegations raised by the complainants. By electronic letter dated I-25 May 2023,
I presented his submissions. A copy of the submissions has been provided to the complainants, therefore the main arguments of the case will be set out below:
' General Regulation on the protection of natural persons in relation to the processing of personal data and on the free movement of such data, and which repeals Directive 95/46/EC.
CDP/COMP/429/2023
vs
THE COMPLAINT
a. that "[the photographs submitted as attachments to my affidavit to the EPRT were taken by me, or by my wife, and they are of our daughter. She is the figure sitting or standing in the foreground of the photo. These were photos taken during my day to day activities, of my daughter at our home. I am informed that according to Article 2(2)(c) of the GDPR, the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity is exempt. This is, first and foremost, the case here because the photos were photos taken as part of our personal/household activities. We took the photos when taking photos of our children at home";
b. that "[a]ccording to the GDPR, it is held that it is allowable to process personal data where necessary for the establishment, exercise, or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure This is what is happening here, whereby I am presently involved in an ongoing claim before the EPRT involving the complainant as the other party. [...] I have filed the affidavit in question in order to substantiate my legal claim before the EPRT and together with the affidavit have annexed the two photographs forming the subject of the complaint. This is intended to better illustrate the situation to the EPRT and to highlight the problem which constitutes the merits of the appeal. The documentation was sent by email only to the persons directly involved in the legal claim, and therefore to the Tribunal Secretary, the Planning Authority representative who is involved in the said appeal, and the lawyer and architect
who respectively represent the complainant. It is noted that the acts of the EPRT
proceedings, while being tribunal proceedings, are not easily accessible by the public
since one would need to visit the premises of the EPRT, know about the case file and ask to access and view the case file in order to be able to get to a point whereby one could
have the possibility of accessing the photos";
.c that "[what is also very relevant is that even though the photos are being used to substantiate my legal claim, since they were photos taken by me/my wife at our home on our phones, the photos themselves are not of a very good quality and the persons appearing in the background of the photographs cannot be identified at all. The images are so grainy that one cannot identify who amongst them is the minor (as is alleged by the complainant). There is no further data in the images that could identify the persons
appearing in the background. Since they cannot be identified, their privacy is not being infringed"
The submissions of the complainants
.3 In accordance with the procedure of the Commissioner's Office, on 30 May 2023, - that Commissioner provided the complainants with the opportunity to refute the arguments made by the A v . . On the same day, the data subject submitted its arguments, and for the purpose
of this section and since the copy of these submissions was given to her, the main arguments she made will be listed below:
a. that the said photographs expose images of persons who are easily identifiable, among them there are also minors of fourteen (14) years;
.b that these photos constitute "information relating ot an identified or identifiable natural person" and therefore qualify as personal data;
c.
that with these photos, it was triggered.' operation or set of operations which is performed upon personal data, ... such as collection, recording, ... storage', cioe' "processing of personal data';
that it results that these photographs create the objectives of article 1 and recital 10 of Directive 95/46. The complainant continued by referring to article 7 of the Charter of Fundamental Rights of the European Union; and
that the exhibition of the said photographs is eroding the right to privacy as sanctioned in the Charter of Fundamental Rights of the European Union.
e.
The final Submissions of the
4. According to the procedure of this Office, the Commissioner asked the I to refute the arguments made by the complainants. On 13 June 2023, he presented the following main arguments:
a. that the photos are taken by me or his wife and these photos are primarily of their daughter in their home. The Regulation is clear on this point, namely that
b.
The Regulation does not apply to the processing of personal data by a natural person during a purely personal activity or at home and therefore without any connection to a professional or commercial activity;
that the photos were not used commercially but were used for the establishment, exercise or defense of legal claims as part of the appeal currently being heard
before the Environment and 1-Planning Review Tribunal. Both I-I
and his wife, as well as the complainants form part of this appeal before the Tribunal of
Environmental Review and 1-Planning. The I
claims that there was no publication of the photographs, and members of the public cannot access the photographs easily as they are part of the Tribunal's file. Therefore, this is a proportionate use and not an excessive use of the photographs in question;
c.
that the taking of these photographs and their use, both when it was for a purely personal activity, as well as now, form part of an affidavit which is a procedural part of judicial legal procedures before the Review Tribunal of the Environment and Planning, are uses permitted by the Regulation without any violation of the rights of the person identifiable in the photograph; and
that it should be specified that the 1-complainant is not identifiable in the photos presented
with the affidavit in question, and therefore 1-I
he argues that he cannot understand how so much emphasis is being made by the complainants that the photos "expose images of person/s that are easily identifiable" when the photos are so pixellated and out of focus that no person is recognisable.
LEGAL ANALYSIS AND DECISION General Considerations
5. Ili 1-Commissioner examined the submissions made by both parties. Also examine the photographs provided together with the affidavit to the Environment and 1-Planning Review Tribunal in which the 1-complainants and other individuals, including minors, are seen while they were in her residence, in order to determine if this publication does not constitute processing of personal data, as defined in the scope of the Regulation.
6.
The Commissioner considered article 4(1) of the Regulation which defines "personal data" as "any information related to an identified or identifiable natural person ("data subject"); an identifiable natural person is a person who can identified, directly or indirectly, in particular with reference to a means of identification such as name, identification number, location data, online identifier or to one or more factors specific to physical, physiological, genetic, mental identity , economic, cultural or social of that physical person" [emphasis added]. After carefully examining the photographs in question, the Commissioner established that the 1 individuals appearing in the photographs can be recognized and indeed identifiable.
7.
In this regard, the Commissioner noted that in one of the photographs there is a minor. In fact, - that recital 75 of the Regulation classifies children as "vulnerable physical persons" and subsequently, recital 38 provides the "Minors deserve specific protection in
regarding their personal data, because they may not be aware of the risks, the
consequences and their safeguards and rights in relation to the processing of personal data".
Article 2(2)(c) of the Regulation- The domestic exemption
8. As regards the photographs which are the subject of this complaint, 1-| invoke the domestic exemption, which is established in article 2(2)(c) of the Regulation, and which stipulates that the 1st provisions of the Regulation do not apply to the processing of personal data "by a natural person carrying out a purely personal activity or at home".
9. Regarding this point, the Commissioner is aware of the jurisprudence of the Court of Justice of the European Union (ECJ) which interprets the domestic exemption in the strictest way. Meanwhile, - that the European Data Protection Board has provided the "this provision - the so-called domestic exemption - in the context of video surveillance must be interpreted strictly".
10. That therefore, in the Jehova witness judgment, the ECJ was asked to consider whether the collection of the names and addresses of residents by members of Jehovah's witnesses in Finland, and subsequently the dissemination of that date with other members on the online community, they can't
2Guidelines 3/2019 on the processing of personal data through video devices, Version 2.0, adopted on 29 January 2020, para. 12.
are considered to fall under the 1-domestic exemption. The Court decided the "second paragraph of Article 3(2) of Directive 95/46 should be interpreted in the sense that it covers only the activities that take place in the context of the private or family life of the individuals. In this light, an activity cannot be considered to be exclusively personal or domestic, in the sense of this provision, when its purpose is to make personal data accessible to an indefinite number of people, or otherwise
when this activity extends, even if partially, to the public domain, and, therefore, is addressed outside the private sphere of the data processor" 3
1.
Ili 1-Commissioner also analyzed the decision taken by the Provincial Administrative Court in Warsaw, where it was said that "[while ti si undisputed that recital 18 ni the Preamble ot the GPDR refers to online activities, including the use of social networks, as exempted , the Court si of the
view that this should not be interpreted as an example of an absolute exemption, applicable in all situations and to any non-commercial activity of the user on the internet, but should be limited ot those situations in which the processing of data, in particular its disclosure via the internet, does not take place for the benefit of an unlimited public" * [emphasis added].
12. Ili 1-Commissioner referred to the controller's submissions, dated 1-25 May 2023, specifically that "[if si noted that the acts of the EPRT proceedings, while being tribunal proceedings, are not easily accessible by the public since one would need ot visit the premises of the EPRT, know about the case file and ask to access and view the case file ni order ot be
able to get to a point whereby one could have the possibility of accessing the photos". In this regard, the Commissioner recognized and emphasized the 1-procedures of the Environmental Review Tribunal and 1-Planning are not accessible online, individuals who are not directly involved in the appeal and the general public, can still see the files whenever they wish. Therefore, the personal data of the complainants and minors, are accessible to an indefinite number of ' persons. In the background of the CEG's case law, the Commissioner determines that the 1st domestic exemption does not apply to the present case, and therefore, the controller is acting in the capacity of a controller (hereafter referred to as the "controller") for the purpose of article 4(7) of the Regulation.
13. Therefore the Commissioner insists that as soon as 1 - and the controller, used such photographs for the purpose that it was not of a purely personal or private nature, but for the purpose of going to
3Case C-25/17, Tietosuojavaltutettu vs. Jehovan todsijat - religionlinen yhdyskunta of 10 July 2018, para. 42. 4 Provincial Administrative Court in Warsaw, I SA / Wa 338/21 of 19 November 2021.
beyond this, in the present complaint in order to make his case before the Review Tribunal
of the Environment and Planning, the domestic exemption under the Regulation no longer applies
all rules on the protection of personal data stipulated under the same Regulation apply in their entirety.
14. That in the context of the applicability of the domestic exemption, the controller must ensure that every data processing operation has a legal basis. In this regard, article 6(1) of the Regulation provides for a number of legal bases, while article 5 of the Regulation also considers the other main principles for the processing of personal data .
15. As a father, the controller knew with reason that the protection of the rights and the fundamental freedoms of his daughter should be respected, even so, that one in the photo in question was covered. While the 1st Commissioner recognizes that this action is a good and appropriate one, he cannot reconcile the reasons why the controller did not act in the same way in the
in front of the other people who were appearing in the photo. Finally, it is amply clear that if the third parties had been covered, the controller would still have achieved his goal and this -1 complaint would not have had a reason to make it.
In light of what has been said and after the Commissioner has taken into consideration the facts established during the course of the investigation, he decides that such processing activity does not fall under the exemption stipulated in article 2(2) (c) of the Regulation, and therefore the provisions of the Regulation apply in their entirety. Consequently, 1-
in his capacity as a controller he violated article 6(1) of the Regulation when he processed personal data without any legal basis for the processing.
Therefore, the controller is being notified with a canfira according to article 58(2)(b) of the Regulation.
lay Deguara
Commissioner for Information and Data Protection
Today, het 25T t July, 2023
The Right of Appeal
In terms of article 26(1) of the Data Protection and 1-Privacy Act (Cap. 586 of the Laws of Malta), "[a person to whom a binding legal decision of the Commissioner has been addressed, has the right to appeal in writing to the Tribunal within twenty days from when it is notified of the said decision as provided in article 23".
An appeal to the Appeals Tribunal regarding 1-Information and 1-Data Protection must be made in writing and addressed to:
The Secretary,
158, Triq il-Merkanti, Valletta
