BlnBDI (Berlin) - 632.276, 521.11692, 591.616
| BlnBDI - 632.276, 521.11692, 591.616 | |
|---|---|
 | |
| Authority: | BlnBDI (Berlin) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 19.05.2022 |
| Published: | |
| Fine: | 1000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 632.276, 521.11692, 591.616 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | EDPB (in EN) |
| Initial Contributor: | Lauren |
The controller, a photographer, was found by the Berlin DPA to be in breach of Article 6 (1) GDPR as he did not document consent from data subjects and failed to establish other legal basis for the publication of data subject's photos on his website.
English Summary
Facts
The controller is a photographer who offered photo shoots as an official event photographer in the field of youth sports. He ran a small company as sole proprietor. In 2018, he provided preview pictures taken by himself as official photographer at an international water diving competition in Croatia. A total of 16.392 pictures of the participating children and adolescents from the age groups 6 to 18 years old were offered for sale on his website between 12 July 2018 and 7 September 2021. The photos can be categorised on the controller's website specific to each subcategories of the participants "Boy A" "Girl B" etc. The photos can be bought individually by any person without registration either for private use or editorial use, as a digital download, CD or on a USB stick.
The children and adolescents depicted in the photos and their legal guardians have not consented to the publication and sale of the photos by the controller.
Holding
The Berlin DPA held that the controller's the conduct infringed Art. 6 (1) in conjunction with Art. 83 (5) (a) GDPR for the following reasons.
Article 6 (1) GDPR sets out that the processing of personal data is only permitted if one of the conditions under Art. 6 (1) (a) to (f) GDPR is met. The DPA considered the publication of photos of children and adolescents without their consent or their legal guardian's consent infringed Article 6 (1) GDPR.
The DPA considered whether Article 85 (2) GDPR and German national law (Sections 22, 23 KUG (Act on Copyright in Works of Fine Arts and Photography) and Section 19 (1) of the Berlin Data Protection Act (BlnDSG)) provided derogations or exemptions from Article 6 GDPR, for processing operations carried out for journalistic purposes where this was necessary to reconcile the right to the protection of personal data with the freedom of expression in journalism. The DPA cited the ECJ in Sergejs Buivids/Datu valsts inspekcija: It cannot be assumed that any information published on the internet which relates to personal data falls within the notion of journalistic purposes. Publications in the online world can only be classified as journalism if they have a minimum journalistic-editorial content. A sufficiently journalistic-editorial level exists if the opinion forming effect for the general public is a defining component of the offer and not merely an ornamental accessory.
Accordingly, the DPA found that the publication of the photos cannot be classified as data processing for journalistic purposes because the photos had not been edited and there was no restriction on their further use for journalistic purposes. The controller did not deal with the content of the photos but merely offered the photos for sale with the clear focus on commercial exploitation. Hence, the journalism exemption under Sections 22, 23 KUG and Section 19 (1) of the Berlin Data Protection Act (BlnDSG) did not apply to this case, and the controller still need to have a legal basis under Article 6 (1) GDPR for his processing activities.
The DPA also found that there was no legally valid consent of the children and adolescents for the publication of the photos according to Art. 6 (1) (a) GDPR, as the controller did not provide the DPA with any documented consent. The controller argued that he had obtained verbal consent from the participants and it was common for participants to give consent when they registered for the event. Such argument was rejected by the DPA as the present case was about publication of photos for sales purpose, not about the taking of photos. Publication required verifiable consent, and it was the controller's obligation to document such consent.
The DPA rejected the application of Article 6 (1) (b) GDPR as there was no contract between the photographer and the data subjects or their legal guardians for taking photos of data subjects.
The DPA also held such processing cannot be based on legitimate interest pursuant to Article 6 (1) (f) GDPR. the DPA assumed the controller had legitimate interest due to the official invitation to the event and the organizer's interest to document this event, but it must be balanced against the data subject's fundamental rights. The DPA referred to recital 47 GDPR, which assumes that children under the age of 16 are in greater need of protection, and their interests therefore generally outweigh Article 6 (1) (f) GDPR. In the present case, the publication of the photos affected the data subjects' right to respect for private and family life under Article 7 CFR and their right to protection of personal data under Article 8 CFR, whilst the publication of photos primarily serve commercial purpose and easily accessible worldwide. Accordingly, the data subject's interests to be published online outweighed the controller's legitimate interest in the sales of photos.
Since no legal basis can be established under Article 6 (1) GDPR, the DPA imposed a fine of 1000 EUR for the unlawful processing.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
