DPA case 07121-1/2020/527 – Order (Slovenia, 2020)

The Information Commissioner (hereinafter referred to as IP) received a request for an opinion. The applicant provided that stranger took a photo of their employee in the office despite that employee's objection to a request for a photograph. The photo was then published in an article. The applicant wanted to clarify whether such a processing constitutes a violation of the data protection law. The IP reminded the applicant that it can make a specific assessment of whether the case describing is a violation of personal data protection rules only through an inspection process. The IP then explained what constitutes personal data in accordance with Article 4(1) GDPR. In light of the definition contained therein, photographs may be considered personal data protected under the GDPR if they determine or enable the determination of an individual, especially when the individual is clearly and unambiguously visible on the photograph and could thus be identified, or when other personal information about the individual is processed together with the photo (eg, first and last name, birth year, etc.). Therefore, if a photograph can be considered as personal data, most likely, its collection, storage as well as all subsequent processing operations, e.g. by posting can qualify as processing personal data. Any processing of personal data must rely on a legitimate and appropriate legal basis. These are set out in Article 6(1) GDPR. The controller is responsible for choosing the right legal basis for the processing of personal data, taking into account the specific circumstances and purpose of the processing. According to previous opinions issued by the IP, the operators shall obtain in advance a consent from an individual in accordance with Article 6(1)(a) GDPR for the processing of photographs in a way that can easily identify the depicted individual.