DPA case CDP/COMP/429/2023 – Complaint Upheld (Malta, 2023)

Complaint Upheld
Information and Data Protection Commissioner25 July 2023Malta
final
Complaint Upheld

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

A person took photos of a neighbor's home for a legal claim, capturing the neighbor and their child in the background. The data protection authority ruled that this violated privacy rules because the photos were accessible to others. This case highlights the need for caution when using personal images in legal contexts.

What happened

An individual took photographs of a neighbor's home that included identifiable personal data.

Who was affected

The neighbor and their child who appeared in the photographs taken without consent.

What the authority found

The data protection authority determined that the use of the photographs violated privacy rules because they were not purely personal and could be accessed publicly.

Why this matters

This case illustrates the importance of respecting privacy when using personal data in legal matters. Individuals and organizations should be aware of the implications of sharing identifiable images.

GDPR Articles Cited
Automatically processed
Art. 2(2)(c) GDPR
Art. 4(1) GDPR
Art. 6(1) GDPR
Art. 58(2)(b) GDPR
View original scraped data
Art. 2(2)(c) GDPR
Art. 6(1) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Secondary-source text retrieved.

Automated check recorded — 18 October 2026.

Processing notes: articles corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

On the 17th March 2023 the data subject lodged a complaint. An individual (the controller) had taken photographs of the data subject's home from their own home as part of a legal claim. In the photos the data subject and their child appeared in the background. These photos, due to being part of a legal claim, were sent to the Review Tribunal of Environment and Planning. The controller argued that the photographs were not processed in connection to a professional or commercial activity and that therefore the exemption under Article 2(2)(c) GDPR applied. Article 2(2)(c) GDPR states that the GDPR will not apply if the data is processed in the course of a purely personal or household activity. They also argued that the photos themselves were so grainy that the data subject could not be identified and that the data was not easily public as one would have to go personally to the Tribunal to view the photos. First, The DPA noted that the household exemption under Article 2(2)(c) GDPR must be interpreted strictly as per CJEU case law and EDPB guidelines. Processing cannot be considered purely personal when the personal data becomes accessible to an indefinite number of persons, or when this activity extends, even if partially, to the public domain. As the personal data was used for a legal claim the household exemption under Article 2(2)(c) GDPR could not apply. Second, the DPA considered that the definition of personal data under Article 4(1) GDPR refers to any 'identifiable person.' The DPA examined the photos and determined that the data subject and their child could be recognised from the photos and were therefore, identifiable. The DPA also considered that one of the individuals was a minor which required special protection under recitals 38 and 75 GDPR. Third, while it is true that the records of the Review Tribunal of Environment and Planning are not available online, the records are nonetheless publicly available. Any number of people could view the photograph

Outcome

Complaint Upheld

A data subject complaint that was upheld by the DPA.

Related Enforcement Actions (0)

No other enforcement actions found for DPA case CDP/COMP/429/2023 in MT

This is the only recorded action for this entity in this jurisdiction.

Details

Decision Date

25 July 2023

Authority

Information and Data Protection Commissioner

GDPRhub ID

gdprhub-7601

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. DPA case CDP/COMP/429/2023 - Malta (2023). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: