We’ve talked for many years now about the overreach of the GDPR and how its concepts of “data protection” often conflict with both concepts of free expression and very common every day activities. The latest example, first highlighted by Neil Brown, is that a Dutch court has said that a grandmother must delete photos of her grandkids that she posted to Facebook and Pinterest, because it violates the GDPR. There is, obviously, a bit more to the case, and it involves a family dispute involving the parents and the grandmother, but, still, the end result should raise all sorts of questions.
And while many EU data protections folks are saying this was to be expected based on earlier EU rulings regarding the GDPR, it doesn’t make the result any less ridiculous. As the BBC summarizes:
The case went to court after the woman refused to delete photographs of her grandchildren which she had posted on social media.
The mother of the children had asked several times for the pictures to be deleted.
The GDPR does not apply to the “purely personal” or “household” processing of data.
However, that exemption did not apply because posting photographs on social media made them available to a wider audience, the ruling said.
There are a few interesting elements in the actual ruling. First, the court notes that since no one made a copyright claim, it doesn’t sound like the parents hold the copyright on the images — which is notable only in that the court seems to think it’s natural to use copyright to censor a grandma proudly posting photos of her grandkids.
But on the GDPR question, it notes that the lack of evidence regarding the privacy settings the grandmother used leads the court to assume they were posted publicly:
The General Data Protection Regulation (hereinafter: AVG) protects the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. However, this Regulation does not apply to the processing of personal data by a natural person in the exercise of a purely personal or household activity. Although it cannot be excluded that the placing of a photo on a personal Facebook page falls under a purely personal or household activity, in the preliminary opinion of the Court in preliminary relief proceedings, it has not been sufficiently established how [defendant] set up or protected her Facebook account or her Pinterst account. It is also unclear whether the photographs can be found through a search engine such as Google. In addition, with Facebook it cannot be ruled out that placed photos may be distributed and may end up in the hands of third parties. In view of these circumstances it has not appeared in the scope of these preliminary relief proceedings that there is a purely personal or domestic activity of [defendant]. This means that the provisions of the General Data Protection Act (AVG) and the General Data Protection Implementation Act (hereinafter: UAVG) apply to the present dispute.
And, then you combine that with the fact that children are involved, and the court says, yup, GDPR requires takedown:
The UAVG stipulates that the permission of their legal representative(s) is required for the posting of photographs of minors who have not yet reached the age of 16. It has been established that the minor children of [plaintiff] are under the age of 16 and that [plaintiff], as legal representative, has not given permission to [defendant] to post photographs of her children on social media. In the case of [child 1], his father did not give [defendant] permission either. In view of this the Court in preliminary relief proceedings will order [defendant] to remove the photo of [child 1] on Facebook and the photo of [plaintiff] and her children on Pinterest. In addition, [defendant] will be prohibited from posting pictures of the minor children of [plaintiff] on social media without permission (as referred to in the AVG and UAVG). The emotional importance of [defendant] to be allowed to place photographs on social media cannot lead to a different judgment in this respect.
Neil Brown, who highlighted this situation in the first place, has pondered that even if grandparents posting pictures of their grandkids is normal behavior, that doesn’t mean it’s good and it removes “autonomy” over our own data. I have a ton of respect for Brown, but this is a very European view that includes an assumption that we should have “autonomy” over anything about ourselves — which, when judged against the harsh light of reality, seems incredibly silly.
Yes, there are cases where people will have things posted online about themselves that they’d rather are not there. And I understand that this is an even more fraught area when it comes to children. But there are very real free expression concerns as well, and the ability to use this as a tool of blatant censorship seems way too likely.
Court Tells Grandma To Delete Photos Of Grandkids On Facebook For Violating The GDPR
More Law-Related Stories From Techdirt:
Let’s Talk About ‘Neutrality’ — And How Math Works
After FBI Successfully Breaks Into IPhones, Bill Barr Says It’s Time For Legislated Encryption Backdoors
More Than A Game: The COVID-19 Pandemic Has Turned Esports Into An Economy Of Its Own