DPA/GDPR breach or not?/

[newmoses]

Not sure if this is the correct forum,but it's the only 1 closest to my query, it involves an employee.

 

Last week when England knocked out Colombia,

there were fans congregating in a town center ,

blocking the road,

and 2 buses were blocked in.

 

Several dozen fans were converging on one of the buses which was immediately outside the pub.,

rocking it,

opening the entrance doors via the outside emergency door button.

 

The driver attempted 3 or 4 times to gently shove a few fans off.

1 fan actually got onto the roof and was jumping on the roof.

 

A harrowing experience for the several passengers on board,

some of whom were young women.

 

All the time this was happening,

someone was filming the incident.

 

All of a sudden,

the video clip is on Youtube.

 

The driver concerned is angry that this video clip is on youtube ,

uploaded by a local taxi firm.

 

The driver never gave his permission for the video clip to be uploaded or for the drivers face to be shown.

The taxi firm did not ask the bus company if they could upload it either.

 

Not only was it embarrassing for the driver at the time of the incident,

but it was also a shock for him when he saw the video clip on Youtube,

which has gone viral,

and has had over 66,000 hits.

 

The bus driver asked me if there is a breach of the Data Protection Act 2018,

and/or a breach of the GDPR.

 

As I am not clued up much on both,

I cannot give a positive answer

 

So,

any help and advice would be greatly appreciated.

I will print it off and give it to the employee.

Edited July 7, 2018 by DragonFly1967
Added some spaces and paragraphs :)

[DragonFly1967]

OK, to start, I should say that I have also seen the video on youtube.

 

This is not a breach of the DPA and/or the GDPR for many reasons.

 

Although the drivers face can be seen, there is nothing contained in the video (with the exception of his face) that identifies them personally. As the incident took place in public and was filmed in public, there is no right to or expectation of privacy. Anyone can film anyone else in a public place and they do not need the permission of anyone else to do so. Annoying? Sometimes yes, especially when you're just trying to do your job, but it's just one of those things when every man and his dog is carrying around a broadcast quality camera in their pocket I'm afraid.

 

I really can't understand why the bus driver is embarrassed by this incident. It's not like they got off the bus and provided them with a set of steps to help them climb on top. There was nothing that the driver could have done to prevent this from happening apart from mowing down countless idiots that were standing in the road (which, after watching the video, I'm sure was sorely tempting) so they have absolutely nothing at all to be embarrassed about.

[Old Cogger]

sounds all a bit childish by the driver - what has he got to loose? working legally is he not?

[steveod]

Actually the above post by dragonfly is not entirely correct.

 

Whilst it is true there is no expectation of privacy in public places and there is no law prohibiting filming is public,

this means there has been no tort of the invasion of privacy.

 

However the GDPR is another matter entirely.

 

By the person uploading it to YouTube without permission,

and the drivers personal data ie his facial image has been shared,

this is not compliant with the GDPR.

 

It doesn’t matter that you or I may not be able to identify him,

other people might.

 

The only time that it could be shared online without permission is If it’s in the interests of the public and for freedom of the press/expression.

 

I do not see how that would apply in this case and the consent of the driver should have been obtained.

 

Old Cogger said:

sounds all a bit childish by the driver - what has he got to loose? working legally is he not?

 

That is of no relevance. He didn’t consent to his image being posted online and is offended/embarrassed/shocked/whatever else by it being placed online without his consent. Not in the interests of the public or for journalistic reasons either. Clear breach of GDPR

[DragonFly1967]

I'd agree with that completely if it was uploaded for a commercial purpose, then I do think the GDPR (at the very least) would apply. But what we're talking about here (basically) is: A member of the public, uploading footage of other members of the public, that was filmed in public, for no commercial gain.

 

I'm just not convinced that there's a breach, or at least, not one that could be proved/actioned.

[Old Cogger]

what is this country coming too? nanny state!

[steveod]

 

Think you approaching it from incorrect angle. It's not whether it's processed for commercial purposes in order to breach gdpr, rather if it's not purely for domestic or household purpose then it's a breach of gdpr. CJEU ruling in reynes. And number of UK CoA rulings.

 

 

In terms of data protection it's not.

Other things yes.

 

The problem is the whole scale theft and misuse of our private data from the Russian criminal online gangs and state sponsored misuse of data by Russia and North Korea,

to Cambridge analytica and Facebook all the way to the DVLA selling our personal data to corrupt parking companies.

That's why the gdpr is important.

[DragonFly1967]

It's very difficult to find anything that discusses public use (rather than media/journalism use) of cameras for photography/videoing in public. There's lots of information for professional photographers/videographers, journalists (employed & independent) and just about everyone else who uses something with a lens for commercial purposes. But when it comes to Joe Bloggs filming something and uploading it, Google is bereft of anything even remotely meaningful.

 

I think I might email the ICO about this and get a definitive take on it (getting an answer should only take a decade or two)

[steveod]

In the case of this driver in any event,

it was a local taxi firm that uploaded the image.

 

In order to be compliant with GDPR they would have been required to give the driver a privacy notice

ie if the event was recorded by their cctv then the required signs would have been necessary,

 

if they had of handed the cctv to the police so that action could be taken against the hooligans vandalising the bus then that would have a lawful reason,

but just posting the video online without consent is definitely a breach of GDPR.

[newmoses]

I think the taxi firm were sending a message out to the public.....

."Don;t get the bus, get a taxi"...…

 

I too believe there is a breach of GDPR,

but wanted to be absolutely certain,

 

which is why i have posted on here for expert(hopefully) advice.......

 

I am aware that the bus company are seeking tp pursue the assailant on the roof of the bus for damage to the roof of the 1 year old bus.

 

Here is what I looked up on Wikipedia.....

 

The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

 

It also addresses the export of personal data outside the EU and EEA areas.

The GDPR aims primarily to give control to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.[1]

 

Superseding the Data Protection Directive 95/46/EC,

the regulation contains provisions and requirements pertaining to the processing of personally identifiable information of individuals (formally called data subjects in the GDPR) inside the European Union,

 

and applies to all enterprises,

regardless of location,

that are doing business with the European Economic Area.

 

Business processes that handle personal data must be built with data protection by design and by default,

meaning that personal data must be stored using pseudonymization or full anonymization,

and use the highest-possible privacy settings by default,

 

so that the data is not available publicly without explicit,

informed consent,

and cannot be used to identify a subject without additional information stored separately.

 

No personal data may be processed unless it is done under a lawful basis specified by the regulation,

or if the data controller or processor has received an unambiguous and individualized affirmation of consent from the data subject.

 

The data subject has the right to revoke this consent at any time.

 

Clearly a breach of GDPR.

[dx100uk]

there is no breach of anything

 

the person that took the video was standing on public land ….the events were viewed from public land...

 

there are no laws whatsoever that prevent such actions . nor the uploading of the video anywhere...

[steveod]

Sorry DX but you are incorrect.

They had no right to post the video online.

 

It was not posted for journalistic reasons or for reasons in the public interest and the driver was clearly the focus of the video together with the person damaging the bus.

 

As in my earlier post if they had of just provided the video to the police or to the bus company then that would not of breached the GDPR, but putting it online has.

 

The video of the perp would probably not have breached the GDPR as they could claim to have posted it in order to try identify him but they should have blurred out the drivers face or got his consent.

Edited July 9, 2018 by dx100uk
quote

[stu007]

Can you please tell us which Article of the GDPR has been breached as there are over 99 Articles in the GDPR this may help to clarifiy your position.

 

I have to also agree there has been no breach of the GDPR.

[steveod]

There has been 2 breaches of the GDPR.

1. Art 12 and Art 13 have been breached by the taxi firm as they have not provided the requisite notification to the bus driver as required by the GDPR

2. The images of the driver on the video, is the personal data of the driver - this cannot be disputed. In order to process(use, transfer, store, delete, etc) personal data then there are only 6 lawful basis and the controller/processor MUST be able to show that the processing is lawful under one of these(Article 6) - they are:

1. consent

2. contract

3. legal obligation

4. vital interests of the data subject

5. task in public interest

6. legitimate purposes of the data controller which are not overridden by the rights and freedoms of the data subject

 

The taxi firm cannot rely on any of these for posting the personal data of the driver on the Internet and so they unlawfully processed the data.

[Ethel Street]

Just to clarify steveod are you saying that if a private individual takes a photo in a public place in which the faces of other people are recognisable and posts it on a public website it's a breach of GDPR unless they get the consent of everyone whose face appears in it?

[steveod]

not exactly.

 

the court cases have ruled where the focus of the images appear to be on a person or number of people then the consent of those people would be required.

 

people that are in the background and not the focus of the picture and so probably not entirely recognisable do not need to give consent.

 

However, consent may also not actually be required as a legitimate reason could be used, for example, at a racing event if i take a picture of a racing car speeding past and the people on the other side of the track show in the picture then

a)because they not the focus of the picture and

b)because there is a legitimate reason for the picture and that people attending such an event would expect people to take photos or videos, then that would be lawful.

 

on the other hand,

me taking a picture of someone picking their nose whilst sitting in their car and posting it all over facebook or youtube would breach the GDPR as no consent and no legitimate reason for posting it.

[dx100uk]

Steveod you are wrong

dont make things up

 

There are no laws whatsoever if filmed from a public space

 

There is no expectation of privacy of anyone.

[Old Cogger]

At the BBC I was informed they are obliged to get permissions to film using individuals i.e. direct at individuals (consent) but actual actions filming etc then film but edit if necessary as so not to break human rights = very difficult at times to differentiate = every situation will be different subject to events at the time.

[steveod]

So you are a Data Protection specialist?

Have you reviewed the case law?

 

It doesn’t make any difference whether filmed in public, in private, from a private premises to a public premises or vice versa.

ALL personal data processing is subject to the GDPR laws.

 

I recommend you go view the ICO guidelines on cctv, body worn cameras and drones as these are used for filming in public places and as you will plainly see are subject to GDPR as well. And read the Reynes judgement from CJEU as well as the Lindquist cjeu judgement.

 

there is also a couple of uk cases I can show you where it was ruled uploading personal data to a website was in breach of data protection act.

 

It’s not the filming that’s the issue. It’s the posting online without consent or legitimate reason that is.

[dx100uk]

go for it steve but waste your own money not someone elses.

go see a solicitor and pay for a consultation on that mobile phone footage eh!

 

theres is no claim under GDPR anywhere,

it was filmed in a public place from a public place

end of.

 

I dont need to know anything about silly ifs and buts or CJEU rubbish either..

it wasn't a drone...it wasn't a body worn camera...it wasn't a CCTV system..[all do have some limitations]

 

 

it was a pers hand held device

 

just know someone who is very high up in the UK equiv of the USA 1st amendment auditors ….

 

as I said stop making things up...there is NO BREACH of anything...

[steveod]

You know someone that is very high up.

That really doesn’t mean anything.

 

You know a lot and help many posters but that doesn’t make everyone else wrong.

 

It doesn’t make any difference how the footage was obtained, handheld mobile, cctv, drone, body camera, satellite.

 

issue was the posting of the drivers image on the internet, who had done nothing criminal, without his consent and without legitimate reason and causing him distress.

 

I don’t need to consult a solicitor I have plenty of data protection experience as my job.

 

Please show me where in the GDPR or the DPA 2018 it excludes the processing from the obligations of lawful basis of processing of personal data when the personal data has been obtained in a public place. There is no such exclusion or exemption.

 

And it’s no use just rubbishing the cjeu, those rulings are binding and show that recordings or images of people obtained in a public area are personal data and can only be processed without consent where the data subject has committed a crime or for the legitimate reason of freedom of expression.

 

you believe whatever you want, that’s your right.

Edited July 9, 2018 by dx100uk
unnecessary quote removed...spacing added.

[dx100uk]

show you...just go look at the 100's of videos from the UK groups on youtube already from public land...

MOD, USAF, Prisons, etc etc ...none have ever successfully prosecuted anyone using a hand held device..despite all their wonderful and farcical reasons they state in the videos the activists must turn off their cameras and delete the footage.

 

as for me, 35yrs being responsible for data protection in one of the biggest establishments of its kind in the UK

 

….'for the legitimate reason of freedom of expression'...you are getting there.

[steveod]

Freedom of expression relates to posting or processing “in the public interests”.

 

It doesn’t relate to posting for entertainment purposes by a taxi firm where there is no public interest per se.

 

They needed to get the consent of the driver or should have anonymised his face.

 

Just a simple request,

Please show us where in the GDPR it excludes handheld mobiles from the 6 lawful basis for processing of personal data such as in this case of the OP

 

What lawful basis of the 6 does the taxi firm use?

[dx100uk]

and who said 'it's for entertainment purposes'?...not the person that filmed and uploaded it....

 

dx

[stu007]

what about dash cam footage.

 

What about the England fan who jumped on ambulance following World Cup win over Sweden who is then identified by police using social media to ask for footage.