BlnBDI (Berlin) - 632.276, 521.11692, 591.616
| BlnBDI - 632.276, 521.11692, 591.616 | |
|---|---|
 | |
| Authority: | BlnBDI (Berlin) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 19.05.2022 |
| Published: | |
| Fine: | 1000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 632.276, 521.11692, 591.616 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | EDPB (in EN) |
| Initial Contributor: | Lauren |
Pursuant to the Article 60 GDPR cooperation mechanism, the Berlin DPA held that a photographer breached Article 6(1) GDPR for lacking a valid legal basis for the publication of data subject's photos on their website. The GDPR derogation for journalism under German law, which is granted under Article 85(2) GDPR, did not apply as the publication mainly served a commercial purpose.
English Summary
Facts
The controller was a photographer who offered photoshoots in the area of youth sports. In 2018, he provided preview pictures taken as the official photographer at an international water diving competition in Croatia on their website. A total of 16,392 pictures of the participating children and adolescents (data subjects), aged 6-18, were offered for sale on the website between 12 July 2018 and 7 September 2021. The photos could be categorised on the controller's website specific to each subcategories of the participants "Boy A" "Girl B" etc. The photos could be bought individually by any person without registration either for private or editorial use, as a digital download, CD or on a USB stick. The data subjects depicted in the photos and their legal guardians had not consented to the publication and sale of the photos by the controller.
A complaint was filed pursuant of Article 77 GDPR. In the following Article 60 GDPR procedure, the Berlin DPA was the lead supervisory authority (LSA) with the Croatian DPA as a CSA.
Holding
The Berlin DPA held that the controller's conduct infringed Article 6(1) GDPR in conjunction with Article 83(5)(a) GDPR for the following reasons.
Article 6(1) GDPR provides that the processing of personal data is only permitted if one of the conditions under Art. 6(1)(a) to Art. 6(1)(a)(f) GDPR is met. The DPA considered the publication of photos of children and adolescents, without their consent or their legal guardian's consent, infringed Article 6(1) GDPR.
The DPA considered whether Article 85(2) GDPR and German national law Sections 22, 23 KUG (Act on Copyright in Works of Fine Arts and Photography) and Section 19(1) of the Berlin Data Protection Act (BlnDSG) provided derogations or exemptions from Article 6 GDPR, for processing operations carried out for journalistic purposes where this was necessary to reconcile the right to the protection of personal data with the freedom of expression in journalism. The DPA cited the ECJ in Sergejs Buivids/Datu valsts inspekcija: It cannot be assumed that any information published on the internet which relates to personal data falls within the notion of journalistic purposes. Publications in the online world can only be classified as journalism if they have a minimum journalistic-editorial content. A sufficiently journalistic-editorial level exists if 'the opinion forming effect for the general public is a defining component of the offer' and not merely an 'ornamental accessory'.
Accordingly, the DPA found that the publication of the photos could not be classified as data processing for journalistic purposes because the photos had not been edited. There was also no restriction on their further use for journalistic purposes. The fact that some of these Children were athletes who were covered in the press before was of no consequence to the DPA. The controller did not deal with the content of the photos but merely offered the photos for sale with the clear focus on commercial exploitation. Hence, the journalism exemption under Sections 22, 23 KUG and Section 19 (1) of the Berlin Data Protection Act (BlnDSG) did not apply to this case, and the controller still needed to have a legal basis under Article 6(1) GDPR for his processing activities.
The DPA also found that there was no legally valid consent of the children and adolescents for the publication of the photos according to Art. 6(1)(a) GDPR, as the controller did not provide the DPA with any documented consent. The controller argued that he had obtained verbal consent from the participants and it was common for participants to give consent when they registered for the event. This argument was rejected by the DPA as the present case was about publication of photos for sales purpose, not about the taking of photos. Publication required verifiable consent, and it was the controller's obligation to document such consent.
The DPA also rejected the application of Article 6(1)(b) GDPR as there was no contract between the photographer and the data subjects or their legal guardians for taking photos of data subjects. There was only a contract between the photographer and the organiser of the event.
The DPA also held could not rely on legitimate interest (Article 6(1)(f) GDPR). The DPA assumed the controller had legitimate interest due to the official invitation to the event and the organizer's interest to document this event, but it must be balanced against the data subject's fundamental rights. The DPA referred to recital 47 GDPR, which assumes that children under the age of 16 are in greater need of protection, and their interests therefore generally outweigh Article 6(1)(f) GDPR. In the present case, the publication of the photos affected the data subjects' right to respect for private and family life under Article 7 CFR and their right to protection of personal data under Article 8 CFR, whilst the publication of photos primarily served commercial purpose and the photos were easily accessible worldwide without further protection. Accordingly, the data subject's interests to be published online outweighed the controller's legitimate interest in the sales of photos.
Since no (other) legal basis could be established under Article 6(1) GDPR, the DPA imposed a fine of 1000 EUR for the unlawful processing on the controller.
Comment
There was no specific mention in the decision regarding the Article 60 GDPR procedure that resulted in this decision. However, a 'Croatian DPA reference number' was used on the first page. The Berlin DPA stated at the end of the decision that the finding of infringement was based on a complaint pursuant of Article 77 GDPR'. The EDPB published this decision on its website in the category of Article 60 decisions. It is therefore likely that the Berlin DPA was the LSA and the Croatian DPA was the originating CSA in this decision.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
