Persónuvernd (Iceland) - no. 2020010552
From GDPRhub
| Persónuvernd (Iceland) - no. 2020010552 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 2(2)(c) GDPR Article 10 of the European Convention on Human Rights Article 73 of the Icelandic Constitution Article 71 of the Icelandic Constitution |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 17.11.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | no. 2020010552 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Icelandic DPA (in IS) |
| Initial Contributor: | Florence D'Ath |
The Icelandic DPA dismissed a complaint relating to the publication and sharing of pictures of a teenage child on Facebook, on the ground that it was not competent to rule on whether the parties involved in this publication had exceeded the limits of their freedom of expression.
English Summary
Facts
The parent of a teenage child (Parent A) filed a complaint with the Icelandic DPA regarding the publication of pictures of the child in question on the Facebook page of the other parent (Parent B), as well as on the Facebook page of a third party (the Third Party). The pictures were published together with defamatory comments towards Parent A, due to a dispute between Parent A and Parent B regarding the custody of the child. Parent A wanted to have these pictures removed from Facebook.
In the course of these proceedings, the Icelandic DPA received the views of all the parties involved, including of the child. In particular, the Icelandic DPA contacted the child by telephone and invited him to express his opinion on the publication of the pictures in question on Facebook. The child admitted that he had not been in contact with Parent 2 since the publication of the pictures, but that he would prefer to have them removed from any Facebook's pages, whether public or private.
Holding
The Icelandic DPA first stated that the child was identifiable on the pictures, and that the publication of the pictures and the accompanying comments therefore consisted in the processing of personal data under the GDPR.
The Icelandic DPA then considered whether such processing of personal data could fall within the household exemption set in Article 2(2)(c) GDPR. In the affirmative, the processing in question would not be subject to the rules set in the GDPR. The Icelandic DPA pointed out in this respect that the household exemption can only apply in connection with the sharing of personal data on closed social media accounts directed towards the private sphere (that is, accounts which only include a limited number of persons, and are not directed towards the larger public). It was found from the case file and the conducted investigation that the photographs of the child were accessible to all Facebook users, without any specific restrictions. Hence, the exemption to the material scope of the GDPR set in Article 2(2)(c) GDPR could not apply in the case at hand.
The Icelandic DPA then analyzed the relation between freedom of expression on the one hand, and the right to privacy and data protection on the other hand. It considered in particular that, by publishing the pictures in questions, Parent 2 had exercised his/her right to freedom of expression, to alert the public on the difficult situation that he/she was going through with respect to the custody of the child. The Icelandic DPA noted however that freedom of expression is not an absolute right, but may be restricted by law where considered necessary for protecting the rights and interests of others, such as the right to privacy and data protection of Parent 1 and of the child.
By further looking into its tasks and missions as defined in the applicable data protection law, the Icelandic DPA considered that it did not have the power to render a binding decision on the limits of freedom of expression as guaranteed by the Icelandic Constitution, but that such disputes should be subject to judicial review instead.
Based on these considerations, the Icelandic DPA ultimately declared itself incompetent to rule on whether Parent 1 or the Third Party had exceeded the limits of their freedom of expression when posting the photographs of the child and the accompanying comments on Facebook. The Icelandic DPA therefore rejected the complaint.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Individuals FAQ complete FAQ electronic monitoring general privacy right to be forgotten right to information about their genotype What is processing? A new privacy legislation 2018Almennt the new legislation other interesting stuff educational booklet: Privacy children's booklet: Private youth booklet: public companies and administration asked and answered all the questions and answers electronic monitoring general privacy access right controllers, processors and vinnslusamningarÁbyrgðarskyldaVinnsluskrárNý Privacy legislation 2018FræðsluefniLög and reglurLög privacy rules and regulations other sacrificed rules and guidelines operating international and European law Solutions Solutions Reviews Licensing Various letters Privacy function Privacy News Mega political process personal data my campaign? How to process personal data in election campaigns? Staff and management for media requests for promotional events policy and gi ldiAnnual Reports201620152014201320122011201020092008200720062005200420032002200120001999Other ContentPrivacy PolicyLegal DisclaimerAccessibilityService DeskTwitterEnglishDecisions in EnglishContactLearningTo reportTopic
Enter keywords
SolutionsReviewsLicensingMiscellaneous letters
Search for solutions
Year from:
Year to:
Search
Complaint about posting photos on social media dismissed
Case no. 2020010552
17.11.2021
The Data Protection Authority has dismissed a complaint about the publication of photographs of a teenage child on the child's parent's Facebook page on the one hand and on the legal entity's Facebook page on the other. In both cases, the pictures appeared with a text entry describing certain attitudes. The Data Protection Authority considered that the publication of the photographs had been so closely linked to the text entries themselves that both should be regarded as an inseparable whole. The Data Protection Authority dismissed the complaint on the grounds that the institution was not competent to rule on whether the parties in question had exceeded the limits of their freedom of expression according to the constitution.
Decision
On October 21, 2021, the board of the Data Protection Authority made the following decision in case no. 2020010552 (formerly 2019102050):
I.
Procedure
1. Outline of case
On October 29, 2019, the Data Protection Authority received a complaint from a [...] lawyer on behalf of [A] (hereinafter the complainant) over the publication of photographs of [the complainant's child, B], [...], on the Facebook page of [the other parent of the child, C] [...] on the one hand and the Facebook page of [the legal entity D ] on the other hand.
By letters dated On 9 January 2020, [C] and [D] were notified of the complaint and offered explanations. No replies were received from [C] and the letter from the Data Protection Authority to [D] was sent back to the agency. The errands of the Data Protection Authority were repeated in letters dated 1 and 15 September 2020. On 29 September 2020, the Data Protection Authority received a reply [...] f.h. [legal entity D]. Then the Data Protection Authority received a reply [...] on behalf of [C] on October 8, 2020. By letter dated At 28:00, the complainant was invited to comment on the content of the above-mentioned letters. Received reply on behalf of complainant by letter dated 3 November 2020. Additional information was received from the complainant by letter dated 16 November s.á. By letter dated February 12, 2021, [C] was given an opportunity to comment on the latter data. A reply was received by letter dated. March 2, s.á.
The Data Protection Authority gave [B] the opportunity to express his views to the agency directly and to that end contacted [B] by telephone on 15 April 2021.
All the above documents have been taken into account in resolving the case, although not all of them are specifically mentioned in the following decision.
The handling of the case has been delayed due to extensive work by the Data Protection Authority.
2. The complainant's views
The complainant relies on the fact that neither [the complainant] nor [the complainant's child, B] has consented to the publication of [...] photos of [B] on the Facebook page [C]. [D] then shared the post in question, also without the complainant's consent or [B]. The photos were published in connection with defamatory remarks towards the complainant due to a dispute [complainant and C]. The complainant considers that the publication constitutes a violation of [B]'s inviolability and the right [...] to have his name [B] and photos of [B] not included in disputes between [complainant and C] in public.
The complainant objects to the view [C] that the publication of the images can be based on point 6. Paragraph 1 Article 9 Act no. 90/2018 and that the legitimate interests [C] outweigh the legitimate interests [B]. The complainant also refers to the rulings of the Data Protection Authority in cases no. 2017/1182 and 2020010723 that a child's attitude towards the publication of images on social media is important, especially with regard to his or her age and development. The complainant considers the text that accompanies the pictures to be very sensitive to [B]. Then the publication of the text and images is not in the interest of [B].
3. Perspectives [of the individual C]
In a letter on behalf of [C] states that [C] and the complainant are involved in hard-fought custody disputes. If the complainant has twice filed a lawsuit against [C] during a [specific] period. [Complainant and C] have joint custody of [their child, B] but the complainant has not complied with the court settlement [...]. The complainant had obstructed contact and communication [C] with [their] child in addition to the fact that communication [B] with [family C] had been blocked, according to the complainant at [the child's own request]. [C], on the other hand, considers [child B] to have [used] mental violence through indoctrination and parental exclusion, and [C] has therefore in his desperation published the post in question on his Facebook page. In addition, [C] posted pictures on the same page so that [B] should have the opportunity to see that [B and C] had a good time together as a family. [C] therefore considers the publication of the image to be in the interests of [B], cf. 6. tölul. Paragraph 1 Article 9 Act no. 90/2018, and therefore lawful, provided that [A and C] have a legal representation [B], cf. Paragraph 5 Article 28 Children's Act no. 76/2003.
4. Perspectives of [legal entity D]
On the part of [D], it is based on the fact that sharing a post on social media cannot be considered a violation of the legal rules on personal data protection, as this is not an independent publication but a reference to another party's website. [D] denies having violated the law with the publication. It is also stated in letter [D] that nothing is known about position [B].
5. Privacy call from [B]
On April 15, 2021, the Data Protection Authority contacted [B], who is [a teenager], by telephone, to inform [B] about the matter and to invite [B] to express his opinion on the publication of the images in question on social media. The role of the Data Protection Authority, incl. with regard to the complaint and the procedure for it, briefly explained.
When asked if [child B] was satisfied with the fact that photos of [B] were published on [C]'s Facebook page, [B] said that he would prefer them to be removed. Then [B] said that he had not discussed the pictures with [C], in fact [B] had not been in contact with [C] since the publication of the pictures. [Child B] was then [submitted] depending on whether [B] factors matter whether the photos were published on an open or closed Facebook page. Said [B] it did not matter.
[B] was asked similar questions about the publication of the photos in question on the Facebook page of [legal entity D]. He said [B] wanted the pictures to be taken from there and also mentioned that [his name would appear] in the text next to the pictures on page [D].
Before the Data Protection Authority contacted [B], the complainant's lawyers and [C] were informed that [B] would be given the opportunity to comment directly to the institution. [C] strongly opposed contacting [B]. By e-mail dated 14 April 2021, the Data Protection Authority informed the lawyers that the institution's obligation to examine [B]'s position was based in particular on Article 12. the United Nations Convention on the Rights of the Child, cf. Act no. 19/2013. Among other things, it stipulates that a child shall be given the opportunity to express himself or herself in any proceedings before a court or administrative authority concerning the child. Furthermore, the Data Protection Authority referred to the opinion of the Parliamentary Ombudsman in case no. 9524/2017, where the ombudsman directed, among other things, the Data Protection Authority to examine the child's position on his own initiative when a complaint is received from his custodial parent.
II. Assumptions and conclusion
1.
Scope
This case concerns, on the one hand, the publication of photographs with a post on an individual's Facebook page and, on the other hand, the sharing of the post by a third party together with the accompanying photos. It is undisputed that the photographs are personally identifiable and their original publication is therefore considered to be the processing of personal information. The division of the entry also includes the re-publication of it and the photographs, but among those that fall under the definition of point 4. Article 3 Act no. 90/2018, on the protection of personal data and the processing of personal data, the concept of processing includes distribution or other methods for making personal data available. In this respect and with reference to para. Article 4, cf. Paragraph 1 Article 39 Act no. 90/2018, this case concerns the processing of personal information.
According to para. Article 4 Act no. 90/2018, they and Regulation (EU) 2016/679 do not apply to an individual's processing of personal data that only concerns his or her personal interests or his or her family or is intended solely for personal use. In cases where personal information, incl. photographs, are published on closed accounts of social media users, such publication can be considered to fall outside the scope of the Act and the Regulation. This generally refers to accounts that are closed to the public and are only visible to those associated with the individual in question on the medium. From the case file, as well as from the Data Protection Authority's investigation, it is clear that the photographs complained about are accessible to all logged in Facebook users. The processing of personal information, which involves the publication of the photographs on Facebook page [C], will therefore not be considered to be covered by the exemption provision of the second paragraph. Article 4 Act no. 90/2018. Furthermore, it is clear from the wording of the article of law that [it] only covers processing by individuals and the publication of the images by [legal entity D] can therefore not fall under the exemption laid down therein. It is clear from the above provisions that this case concerns the processing of personal data. It is then examined whether it falls within the competence of the Data Protection Authority to rule on the legality of the processing measures in question.
2. The relationship between privacy and freedom of expression
An individual's right to privacy, home and family is protected in Article 71. the Constitution of the Republic of Iceland no. 33/1944 and Article 8. European Convention on Human Rights. In Act no. 90/2018, on the protection of personal data and the processing of personal data, further stipulates the right to privacy with regard to the processing of personal data. The law contains provisions that are intended to guarantee the privacy of individuals when processing personal information, among other things by stipulating the obligations of those who process such information. However, Act no. 90/2018 in such a way that human freedom of expression is not violated.
Article 73 provides for the protection of freedom of expression. of the Constitution and Article 10. European Convention on Human Rights. According to those provisions, every person has the right to express his or her thoughts but must be held accountable in court. This right shall also cover the freedom to receive and pass on information and ideas at home and abroad without government intervention. In the comments on Article 73 of the Constitution, in a bill that became the Constitutional Act no. 97/1995, states that freedom of expression is indisputably one of the foundations of a democratic society, but nonetheless one of the most difficult human rights, which cannot be enjoyed without responsibility. Freedom of expression may therefore be restricted by law, inter alia because of the rights or reputation of others, provided that they are considered necessary and in accordance with democratic traditions.
It can be deduced from the case law of the European Court of Human Rights that expression enjoys protection regardless of its content, cf. Murphy's case against Ireland of 10 July 2003 (RJD 2003-IX) and regardless of the form in which it appears, cf. Case of Oberschlick (No. 1) v. Austria of 23 May 1991 (Series A. 204). It is also clear that any kind of action by those in power can hold states accountable on the basis of Article 10. of the Convention on Human Rights. Interventions within the meaning of the provision have included, among other things, a ban on publishing a picture of a defendant, a legal ban on publishing and a ban on broadcasting an interview with a specific group of people.
3. Conclusion3.1.General
As previously stated, the publication of photographs of personally identifiable individuals is considered to be the processing of personal information within the meaning of Act no. 90/2018 and Regulation (EU) 2016/679. The Data Protection Authority has previously ruled on the legality of the publication of such photographs, cf. in particular the ruling of the Agency, dated March 8, 2018 and June 8, 2020, in cases no. 2017/1182 and 2020010723. The previous ruling fell during the period of validity of the older Act no. 77/2000, on personal protection and handling of personal information, but the latter after the entry into force of the current law. The rulings did not address the limits of freedom of expression and privacy, but on closer inspection it is the opinion of the Data Protection Authority that consideration must be given to whether the publication of photographs may constitute an expression that may benefit from the protection of the Constitution and the European Convention on Human Rights. . of the Constitution, Article 10 of the Convention on Human Rights and on the basis of a comprehensive assessment of the context of the publication of the photographs in question.
The tasks of the Data Protection Authority are described in Article 39. Act no. 90/2018, which states, among other things, that the Agency supervises the implementation of the Act, Regulation (EU) 2016/679, special provisions in laws dealing with the processing of personal data and other rules on the subject. It also states that the Data Protection Authority decides whether an infringement has taken place, if the institution receives a complaint from a registered individual or his representative. In practice, the Data Protection Authority has considered that the legal provisions in question do not imply that the institution has the power to make a binding decision on the limits of rights in accordance with the provisions of the Constitution, e.g. freedom of expression according to Article 73 and privacy under Article 71, but such disputes are subject to judicial review. This is seen in the light of the fact that according to para. Article 73 of the Constitution, every person has the right to express his thoughts, but he must be held accountable in court. The provision will conclude that the courts, not the government, will decide whether an expression is in conflict with the law. In this connection, reference is further made to the wording of the first paragraph. Article 10 of the Convention on Human Rights that everyone has the right to freedom of expression "without government intervention". As a result, the Data Protection Authority is not competent to rule on whether an expression constitutes an abuse of the constitutionally protected right to freedom of expression, which is furthermore protected by the latter provision of the Convention on Human Rights.
The Data Protection Authority, on the other hand, has considered that in the case of publication or other processing of information that can be verified in an objective manner, such as by searching the National Registry or other similar means, it is the processing of personal information that the institution is competent to rule on. . In such cases, it falls within the competence of the Data Protection Authority to decide whether the processing is in accordance with Act no. 90/2018 and Regulation (EU) 2016/679, cf. ruling of the Agency, dated 27 August 2020, in cases no. 2020010550 and 2020010610.
3.2.Posting photos on Facebook page [C]
In the opinion of the Data Protection Authority, a comprehensive assessment must be made of the photographs to which the complaint relates and the context of their publication, taking into account the points of view outlined above. It is known that the photos were published together with a text post on [C]'s Facebook page where [C] described his particular views. It is clear that the text entry as such involves expression and that it falls outside the scope of the Data Protection Authority to take a position on whether [C] has violated its constitutionally protected freedom of expression and thus created a legal responsibility. It is also clear that the complainant and [C] have had a dispute over custody of [B] and access to [B].
From the case file it can be deduced that there was a direct connection between the publication of the photographs and the text entry in question. In light of this, it is the opinion of the Data Protection Authority that the publication of the photographs was so closely connected with the expression involved in the publication of the text entry itself that both must be regarded as an inseparable whole. Consequently, and with reference to the views outlined in section 3.1., The Data Protection Authority is not competent to rule on whether [C], by publishing the photographs, went beyond the limits of his freedom of expression according to Article 73. of the Constitution, cf. also Article 10. European Convention on Human Rights. That part of the complaint is therefore dismissed.
3.3. Publication of photographs on the Facebook page of [legal entity D]
As previously reported, [legal entity D] republished post [C] in its entirety on Facebook page [D], i.e. both the text of the post and the photographs that accompanied it. Then [D] added a text describing [D]'s views on what is discussed in post [C]. [...].
Legal entities generally enjoy constitutionally protected freedom of expression. In assessing whether the resolution of the legitimacy of their publication of personally identifiable photographs falls within the competence of the Data Protection Authority, it may therefore in certain cases be necessary to consider whether the publication involves the expression of the party concerned. In such cases, it is necessary to make a comprehensive assessment of the context of the publication, cf. discussion in section 3.2. above.
In view of the case file, it is the opinion of the Data Protection Authority that similar views can apply to the publication of the photographs in question on the Facebook page [D] and apply to their publication by [C]. In particular, the relationship between expression [D] and [activities] [D] is important, as well as with the points of view that appear in the original post [C]. As is the case here, the reprint of entry [C], including the images that appeared with it, will be considered so closely related to the expression contained in entry [D] that no distinction will be made between them.
It follows from the above that the Data Protection Authority is not competent to rule on whether [D] has exceeded the limits of his freedom of expression according to Article 73. of the Constitution, cf. also Article 10. European Convention on Human Rights. That part of the complaint is therefore dismissed.
Note:
Complaint [A] about posting photos of [B] on [C]'s Facebook page is dismissed.
Complaint [A] about posting photos of [B] on [D]'s Facebook page is dismissed.
Privacy, October 21, 2021
Björn Geirsson
Kristín Edwald Sindri M. Stephensen
Vilhelmína Haraldsdóttir Þorvarður Kári Ólafsson
Privacy PolicyLegal DisclaimerAccessibilityService DeskTwitter
