DPA case CDP/COMP/429/2023 – Complaint Upheld (Malta, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A person took photos of a neighbor's home for a legal claim, capturing the neighbor and their child in the background. The data protection authority ruled that this violated privacy rules because the photos were accessible to others. This case highlights the need for caution when using personal images in legal contexts.
What happened
An individual took photographs of a neighbor's home that included identifiable personal data.
Who was affected
The neighbor and their child who appeared in the photographs taken without consent.
What the authority found
The data protection authority determined that the use of the photographs violated privacy rules because they were not purely personal and could be accessed publicly.
Why this matters
This case illustrates the importance of respecting privacy when using personal data in legal matters. Individuals and organizations should be aware of the implications of sharing identifiable images.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On the 17th March 2023 the data subject lodged a complaint. An individual (the controller) had taken photographs of the data subject's home from their own home as part of a legal claim. In the photos the data subject and their child appeared in the background. These photos, due to being part of a legal claim, were sent to the Review Tribunal of Environment and Planning. The controller argued that the photographs were not processed in connection to a professional or commercial activity and that therefore the exemption under Article 2(2)(c) GDPR applied. Article 2(2)(c) GDPR states that the GDPR will not apply if the data is processed in the course of a purely personal or household activity. They also argued that the photos themselves were so grainy that the data subject could not be identified and that the data was not easily public as one would have to go personally to the Tribunal to view the photos. First, The DPA noted that the household exemption under Article 2(2)(c) GDPR must be interpreted strictly as per CJEU case law and EDPB guidelines. Processing cannot be considered purely personal when the personal data becomes accessible to an indefinite number of persons, or when this activity extends, even if partially, to the public domain. As the personal data was used for a legal claim the household exemption under Article 2(2)(c) GDPR could not apply. Second, the DPA considered that the definition of personal data under Article 4(1) GDPR refers to any 'identifiable person.' The DPA examined the photos and determined that the data subject and their child could be recognised from the photos and were therefore, identifiable. The DPA also considered that one of the individuals was a minor which required special protection under recitals 38 and 75 GDPR. Third, while it is true that the records of the Review Tribunal of Environment and Planning are not available online, the records are nonetheless publicly available. Any number of people could view the photograph
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case CDP/COMP/429/2023 in MT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
25 July 2023
Authority
Information and Data Protection Commissioner
GDPRhub ID
gdprhub-7601About this data
Cite as: Cookie Fines. DPA case CDP/COMP/429/2023 - Malta (2023). Retrieved from cookiefines.eu
Last updated: