DPA case Decision 16-11-2021 – Dismissed (Croatia, 2021)

The Croatia DPA received a complaint in which, in essence, the complainant pointed out that a real estate agency (the controller) published their photograph taken during a viewing of an apartment that was advertised for sale, without their consent and knowledge. The photo was available on a public website via an URL link. At the request of the Croatian DPA, the controller stated that they deleted, in good faith, the disputed parts of the photo allegedly representing the complainant. At the same time, the controller argued that they did not believe that, in this case, it was about the complainant's personal data, since the person in the initial photograph was camouflaged in a jacket and a protective face mask. Moreover, the person voluntarily entered the frame during the photo shoot. The Croatian DPA rejected the complaint as unfounded. It pointed out that it was not possible to determine the data subject's identity from the contested photo. In particular, the assessment of identity should be based on objective and reasonable factors so that the average person could determine in an unequivocal way (directly/indirectly) the identity of an individual. The DPA concluded that the identity of the applicant was impossible to determine by objective factors available to the average person, who was not an acquaintance of the complainant, from just looking at the attached photo. The photo was not clear and the face was not visible (mostly covered by a surgical mask). Therefore, the photograph in question could not be referred to as personal data in the sense of Article 4(1) GDPR, so there was no obligation of the controller to delete the photograph. It was only about publishing a photo of a property intended for sale and did not contain personal data.