No right to privacy in public and GDPR

Del2005

There is a thread in motors where someone wants to record people driving in the bus lane and post it to the Web in the hope of shaming the Gardaí into enforcement of bus lanes

https://touch.boards.ie/thread/2057849249/6/#post106387156

This made me think about the fact that you have no right to privacy in a public place but the new GDPR legislation means that you need a valid reason to record my personal data and you need to secure it after you have recorded it.

So how will recording video in public be dealt with and if someone then posts my data to the Internet who is responsible for the data breach? Also will this mean the end of TV outside broadcasts? They can't just set up on a street now and start recording because while they might have a valid reason to be there they don't have a valid reason to record the personal data of anyone passing and they have to delete the data ASAP, so no archive.

It seems that 2 bits of legislation are contradicting each other here.

coylemj

How does a video of you driving in a bus lane (or parking in a disabled spot) constitute 'my personal data'?

Robbo

If you're starting point is that there's no right to privacy in a public setting, anything that follows is going to be misconceived.

There can be an expectation of privacy in public places. It depends entirely on the circumstances; the persons involved, the acts they're doing, the location, the motivation of the parties...even the time of day.

Have a read of some of the "paparazzi" cases and then come back. Campbell v. MGN, Von Hannover, Douglas v. Hello! and the like.

Think about this scenario: You're on the remote island of Inismoon with no person in a 2km radius and decide it's a nice day for a swim. Whilst changing into your trunks the towel falls and, for a matter of seconds, your backside is on display. At this exact moment, a drone zips by and records this minor pratfall. The video then appears online in three ways:

1. On a general video sharing site, titled "Epic Towel Fail lolololol"
2. On a general video sharing site, titled "Sicko exposes himself on beach which children frequent"
3. On a pornographic video site, titled "Inismoon, 9/3/18"

How aggrieved would you be and which publication would you chose to erase first given a chance?

lifeandtimes

Robbo wrote: »

[*]On a pornographic video site, titled "Inismoon, 9/3/18"

Shouldn't this be the "the inismooner"?

Sorry I couldn't resist

punisher5112

Public place is free game.

lifeandtimes

Del2005 wrote: »

This made me think about the fact that you have no right to privacy in a public place but the new GDPR legislation means that you need a valid reason to record my personal data and you need to secure it after you have recorded it.

Filming you walking in the park or driving your car does not constitute personal data

"personal data" means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;"

Robbo

lifeandtimes wrote: »

Filming you walking in the park or driving your car does not constitute personal data

"personal data" means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;"

Video and stills are very much personal data.

Del2005

coylemj wrote: »

How does a video of you driving in a bus lane (or parking in a disabled spot) constitute 'my personal data'?

I forgot to include the Data commissioner website for the new law. Personal data is very wide ranging so if you can identify me from anything it's my personal data and in a few months will have huge protection and large fines for not respecting it.


"Personal data is any information that can identify an individual person. This includes a name, an ID number, location data (for example, location data collected by a mobile phone) or a postal address, online browsing history, images or anything relating to the physical, physiological, genetic, mental, economic, cultural or social identity of a person.

http://gdprandyou.ie/gdpr-for-individuals/

Del2005

lifeandtimes wrote: »

Filming you walking in the park or driving your car does not constitute personal data

It will in 2 months, see my previous post.

ED E

If you want to argue the point that images of cars are personal data with the restrictions normally applied thereof then are you suggesting that all dashcams will need to be ripped out in May?

ArthurG

As far as I'm aware, any personal information that you have made freely known in the public domain isn't covered by the regulation. For example if you go around with a sign around your neck with your name on it, you cannot subsequently apply the regulation if someone uses it.

On that basis, I'd guess that by driving in a public place, you'd fall under the above example.

Del2005

ED E wrote: »

If you want to argue the point that images of cars are personal data with the restrictions normally applied thereof then are you suggesting that all dashcams will need to be ripped out in May?

That's what I want to find out. The GDPR says that anything which can identify me is my personal data and has to have a valid reason for it to be recorded. A dash cam, camera on the street or outside broadcast is not a valid reason to record my personal data.

So how can you have one law that says its OK to record in public and another which has large fines for recording and keeping personnel data without good reason?

Robbo

Del2005 wrote: »

It will in 2 months, see my previous post.

It's personal data now. A side-effect of late GDPR mania is that only now are a large number of people even thinking in these terms so are assuming that everything in GDPR is new.

ED E wrote: »

If you want to argue the point that images of cars are personal data with the restrictions normally applied thereof then are you suggesting that all dashcams will need to be ripped out in May?

Just processed in a responsible manner and respectful of the rights of the subjects.

Del2005

ArthurG wrote: »

As far as I'm aware, any personal information that you have made freely known in the public domain isn't covered by the regulation. For example if you go around with a sign around your neck with your name on it, you cannot subsequently apply the regulation if someone uses it.

On that basis, I'd guess that by driving in a public place, you'd fall under the above example.

If you read the bit I quoted from the data protection website I link to you'll see that my name is my personal data and can't be recorded or distributed without my permission and if stored must be kept securely and disposed of when no longer required.

ArthurG

Del2005 wrote: »

If you read the bit I quoted from the data protection website I link to you'll see that my name is my personal data and can't be recorded or distributed without my permission and if stored must be kept securely and disposed of when no longer required.

I'm not disagreeing with you that your name is personal data, it is. However if you consciously disclose personal info into the public domain, you forfeit certain protections.

Edit: I'm not a lawyer. I work in a large multinational. We had a briefing from a major EU law firm this week on GDPR application, and this point was discussed.

lifeandtimes

ArthurG wrote: »

However if you consciously disclose personal info into the public domain, you forfeit certain protections

For how long and to whom?

If I walk around with a sign that says I'm so and so why and it's recorded. How long cam that be shared online and to whom? Indefinitely?

ED E

ArthurG wrote: »

However if you consciously disclose personal info into the public domain, you forfeit certain protections.

This.

My PPSN say is personal data, but if I tattoo it to my forehead have I not waived my right to privacy regarding it?


The argument with vehicles is your car itself / reg plate identifies you but you're also bringing it into a public place so that nulls your expectation of privacy wrt those two does it not?

coylemj

So are we nearing the stage where an outside news broadcast (reporter talking to camera on busy street) will have to blur out the faces of anyone who just happens to be passing? I know this is currently done most of the time with car registration plates.

For people who don't remember, there are two cases unconnected with modern data protection legislation which media organisations are cognisant of and which concern people going about their business in public places......

1. An RTE news report one Christmas featured a Garda drink driving checkpoint on a main road in Dublin, might have been the N11 near RTE. A female (who just happened to be a barrister) was sitting in line and her registration plate was visible. She successfully sued RTE for (the then tort of) libel on the basis that someone watching the news clip could have come to the conclusion that she was being processed as a drunk driver. I'm fairly sure it was her registration plate alone that was visible and not her face but she still got a payout.

2. Another RTE news report, this time in the city centre. It was about some scam or another and at one stage an outside reporter talked to camera in Henry St. with various people passing by. One of the people who passed by and who could be clearly seen was one Laurence Wren who was the serving or recently retired Garda Commissioner. He sued and got a payout.

Bandito909

With this GDP, in theory, could someone ask their boss for any emails or documents that contain and employees name?

lifeandtimes

Bandito909 wrote: »

With this GDP, in theory, could someone ask their boss for any emails or documents that contain and employees name?

You can do that now

Data request your HR department

But be prepared for things to be ommitted to protect others

Del2005

lifeandtimes wrote: »

For how long and to whom?

If I walk around with a sign that says I'm so and so why and it's recorded. How long cam that be shared online and to whom? Indefinitely?

My face identifies me and I walk around with that in public every day. But from the 25th of May someone recording my face in public will now have my personal data and the GDPR law will mean that they will have to have a valid reason for recording it in the first place and can't keep it if unless they have it securely stored and deleted ASAP when no longer needed.

lifeandtimes

Del2005 wrote: »

My face identifies me

It doesn't though

It only identifies you too people who you know and as such already have your "data"

It doesn't identify you too any other joe soap

Example: someone takes your pic and shows someone who has never met you. No data breach as they have no idea who it is and can't use any info from it

Robbo

Del2005 wrote: »

My face identifies me and I walk around with that in public every day. But from the 25th of May someone recording my face in public will now have my personal data and the GDPR law will mean that they will have to have a valid reason for recording it in the first place and can't keep it if unless they have it securely stored and deleted ASAP when no longer needed.

That's, generally speaking, the current position. GDPR just amplifies a lot of the core rights/responsibilities here.

Vetch

There are media exemptions for filming in public. There is currently a DPC guidance note on body worn cameras. https://www.dataprotection.ie/docs/Guidance-on-the-use-of-Body-Worn-Cameras/1512.htm and another one on drones.
Presumably the DPC would investigate a complaint given they've issued the guidance but I haven't seen a case study.

Car registration is personal data - there is WP29 (EU body of national DP representatives) opinion that says so so the Irish DPC would very likely agree.

GDPR doesn't change a lot for people in the way of basic DP rights. What it does is put more obligations on organisations that process personal data.

Del2005

lifeandtimes wrote: »

It doesn't though

It only identifies you too people who you know and as such already have your "data"

It doesn't identify you too any other joe soap

Example: someone takes your pic and shows someone who has never met you. No data breach as they have no idea who it is and can't use any info from it

From my reading of the website it doesn't matter if the person doesn't not know me, my picture is my data. What's the difference between showing a stranger my picture or my medical history? They don't know me but letting a person see my medical history is definitely an issue as that is my personal data and from May my picture has the same status.

Del2005

Vetch wrote: »

GDPR doesn't change a lot for people in the way of basic DP rights. What it does is put more obligations on organisations that process personal data.

That's what I want to find out. Will the new regulations mean that YouTube, Google, TV stations, etc have to blur all videos taken in public because they have recorded personal data which they don't have a valid reason to have?

Fred Swanson

This post has been deleted.

Vetch

Del2005 wrote: »

That's what I want to find out. Will the new regulations mean that YouTube, Google, TV stations, etc have to blur all videos taken in public because they have recorded personal data which they don't have a valid reason to have?

The people shown in videos could object to their data being processed. Again, this is a current right and not a new one under GDPR.

YouTube etc wouldn't know that people shown in videos haven't consented to their data being processed.

brian_t

Fred Swanson wrote: »

This post has been deleted.

I would have thought that with the latest computer programmes blurring out numberplates would be simple enough.

There is an iPhone App called "HideMyPlate"

GM228

Vetch wrote: »

Car registration is personal data - there is WP29 (EU body of national DP representatives) opinion that says so so the Irish DPC would very likely agree.

They do, I posted briefly about the Article 29 Working Party opinion here.

Del2005

Vetch wrote: »

The people shown in videos could object to their data being processed. Again, this is a current right and not a new one under GDPR.

YouTube etc wouldn't know that people shown in videos haven't consented to their data being processed.

But YouTube will have my personal data on their website so regardless of how it gets there they now will need to keep it secure and delete when no longer required, also what valid reason does YouTube have for keeping my personal data in the first place?

Which opens a bigger can of worms. If they can't be 100% certain that every person in a video has agreed to sharing their data are they not then committing a bigger offence by illegally distrusting personal data. If a newspaper is given a box full of medical records they cannot print them and you'll never see them on a TV station. Why then is YouTube, or a TV station, allowed to distribute people's personal data for commercial gain without consent?

lifeandtimes

Del2005 wrote: »

But YouTube will have my personal data on their website so regardless of how it gets there they now will need to keep it secure and delete when no longer required, also what valid reason does YouTube have for keeping my personal data in the first place?

Which opens a bigger can of worms. If they can't be 100% certain that every person in a video has agreed to sharing their data are they not then committing a bigger offence by illegally distrusting personal data. If a newspaper is given a box full of medical records they cannot print them and you'll never see them on a TV station. Why then is YouTube, or a TV station, allowed to distribute people's personal data for commercial gain without consent?

I think it's a little mire simpler than that.

When you buy a ticket to a gig or festival they advise you on the ticket or the Ts&Cs that it may broadcast and you accept to your data being used.

I can see rte when doing a live broadcast will have a sign up saying filming in progress and if you walk through then you agree to be filmed or you could walk across the other street. They may need acquire a license to broadcast in public but I don't see that being a problem

Regarding dashcams it easy for people to edit their videos to blur things if they wish, that's their issue to deal with though

Vetch

Del2005 wrote: »

But YouTube will have my personal data on their website so regardless of how it gets there they now will need to keep it secure and delete when no longer required, also what valid reason does YouTube have for keeping my personal data in the first place?

Which opens a bigger can of worms. If they can't be 100% certain that every person in a video has agreed to sharing their data are they not then committing a bigger offence by illegally distrusting personal data. If a newspaper is given a box full of medical records they cannot print them and you'll never see them on a TV station. Why then is YouTube, or a TV station, allowed to distribute people's personal data for commercial gain without consent?

In the YouTube scenario, the person who makes/posts the video should get consent and decide on retention. As for YouTube securing your data, they presumably make privacy settings available to account holders.

You can't equate an image of a person with medical records. Both are personal data but medical records fall into a more protected category. They are sensitive personal data and special category data under the DP Acts and GDPR respectively. DP legislation is risk-based: the greater the risk to the fundamental rights and freedoms of data subjects, the more safeguards that have to be in place. That is not to say though that a person might not be compromised or embarrassed by an image.

TV stations have media exemptions.

I agree with the basic point which (I think?) you're trying to make. Video and photo sharing sites erode privacy (not just data protection rights) as the sites are in the public domain, and images can spread like wild fire and be re-posted. All of us are at the mercy of idiots with phones and there should be a huge degree of responsibility on each and every user of social media sites, but not everyone gets it!

What do you see as solutions to the issues you've raised?

Del2005

lifeandtimes wrote: »

I think it's a little mire simpler than that.

When you buy a ticket to a gig or festival they advise you on the ticket or the Ts&Cs that it may broadcast and you accept to your data being used.

I can see rte when doing a live broadcast will have a sign up saying filming in progress and if you walk through then you agree to be filmed or you could walk across the other street. They may need acquire a license to broadcast in public but I don't see that being a problem

Regarding dashcams it easy for people to edit their videos to blur things if they wish, that's their issue to deal with though

You can put a sign in a car park saying that the owner excepts no responsibility for the car, but you can still claim off then if anything happens to your car. Also what about people who can't read, how are they supposed to know that they are getting their personal data recorded and transmitted around the world.

lifeandtimes

Del2005 wrote: »

You can put a sign in a car park saying that the owner excepts no responsibility for the car, but you can still claim off then if anything happens to your car. Also what about people who can't read, how are they supposed to know that they are getting their personal data recorded and transmitted around the world.

There's been a discussion before about that and no you can't, you park in a public place and the owner has a sign saying they accept no liability,then no you cannot claim off them and it does absolve them of any liability provided they are in line with all legislations regarding public car parks.
If your statement was true then no person would ever put up thay sign or let anyone park therem

What about people who cant read? Unfortunately that's their own issue, if they can't read terms and conditions and even in this case the data legislation how will they know if it applies to them or not?

The act covers everyone but it's up to everyone to know and understand it themselves.

Del2005

Vetch wrote: »

In the YouTube scenario, the person who makes/posts the video should get consent and decide on retention. As for YouTube securing your data, they presumably make privacy settings available to account holders.

You can't equate an image of a person with medical records. Both are personal data but medical records fall into a more protected category. They are sensitive personal data and special category data under the DP Acts and GDPR respectively. DP legislation is risk-based: the greater the risk to the fundamental rights and freedoms of data subjects, the more safeguards that have to be in place. That is not to say though that a person might not be compromised or embarrassed by an image.

TV stations have media exemptions.

I agree with the basic point which (I think?) you're trying to make. Video and photo sharing sites erode privacy (not just data protection rights) as the sites are in the public domain, and images can spread like wild fire and be re-posted. All of us are at the mercy of idiots with phones and there should be a huge degree of responsibility on each and every user of social media sites, but not everyone gets it!

What do you see as solutions to the issues you've raised?

YouTube regardless of who posts the data are still responsible for the content, I can request to get my data removed today if I want regardless of who posted it. In May the difference is that YouTube will have to have a valid reason for firstly hosting my personal data, most likely without my consent, and then leaving it excessible to everyone for an unlimited time. They will be leaving themselves open to huge fines.

I was using the medical records as an extreme example but the wording on the GDPR website does not differentiate levels of personal data, so my images now need to be kept as securely as my medical records.

I've no idea what the solution is as we have a new law coming in which places huge emphasis on personal data and we have hundreds of companies that exist solely to distribute personal data without permission. Which is why I started the thread, you have no right to privacy in public but your personal data can't be captured without a valid reason and must be deleted ASAP, after being kept secure.

n!ghtmancometh

I've been taking pics of cars and reg plates of those twats blocking/parked in bus lanes/paths and sending them to garda traffic on twitter for months, including an infamous solicitor who habitually parks his distinctive car on the pavement outside his office near the courts with the hazards on for hours. They don't give a monkeys.

Vetch

Del2005 wrote: »

YouTube regardless of who posts the data are still responsible for the content, I can request to get my data removed today if I want regardless of who posted it. In May the difference is that YouTube will have to have a valid reason for firstly hosting my personal data, most likely without my consent, and then leaving it excessible to everyone for an unlimited time. They will be leaving themselves open to huge fines.

I was using the medical records as an extreme example but the wording on the GDPR website does not differentiate levels of personal data, so my images now need to be kept as securely as my medical records.

I've no idea what the solution is as we have a new law coming in which places huge emphasis on personal data and we have hundreds of companies that exist solely to distribute personal data without permission. Which is why I started the thread, you have no right to privacy in public but your personal data can't be captured without a valid reason and must be deleted ASAP, after being kept secure.

We're going round in circles now but this is how GDPR differentiates between personal data types in terms of a risk-based approach. This is Article 32(1)

1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: