A photographer who specializes in youth sports recently uploaded photos of sporting events to their website, including many pictures of children and teenagers aged 6-18. Does this violate GDPR regulations by infringing on the personal data of these minors? Can the photographer claim freedom of the press?

The photographer in question posted photos taken during an international underwater diving competition in Croatia on their website in 2018. Between July 12, 2018 and September 7, 2021, a total of 16,392 photos of children and teenagers aged 6-18 were sold on the website under various subcategories, such as “Boy A” and “Girl B.”

Anyone can buy these photos individually without registering and use them for private or editorial purposes. However, the subjects of the photos and their parents did not consent to the photographer publishing or selling the photos.

The Berlin Data Protection Authority (DPA) believes that the photographer’s actions as a data controller violated Article 6(1) and Article 83(5)(a) of the GDPR. The Berlin DPA found that publishing photos of children and teenagers without their consent or that of their legal guardians violated GDPR Article 6(1).

While the DPA acknowledged the importance of processing personal data for news purposes, they also emphasized the need to balance the protection of personal data rights with freedom of the press. The DPA cited the European Court of Justice, which stated that not all personal data-related information posted on the internet can be assumed to be for journalistic purposes. Only content with the minimum journalistic-editorial content can be considered news.

Moreover, if the content has a decisive impact on the public’s opinion rather than just being decorative, it can be considered sufficient journalistic-editorial content. The Berlin DPA found that the photos were not edited, and therefore, could not be classified as personal data processing for news purposes. Additionally, the website did not limit the use of these photos to journalistic purposes.

Even if some of the child athletes were minor public figures, the photographer’s uploading of their photos to the internet could not be deemed legal. The photographer, as the data controller, did not process the content of the photos but merely provided them for sale. It was clear that the photographer intended to use the photos for commercial purposes.

Therefore, the Berlin Data Protection Act prescribed a penalty of €5,000 for the photographer’s violation of GDPR regulations. The photographer was also ordered to delete all photos that violated GDPR rules and to ensure that all future photos comply with GDPR guidelines.

The conclusion of this ruling clearly points out the tension between freedom of the press and personal data protection, while also setting a standard for freedom of the press. The standard is that “online publications can only be classified as news when they have the minimum journalistic-editorial content.”

Therefore, in the future, any self-media or news media that wants to argue from the perspective of freedom of the press and claim that they have not violated personal data protection must confirm whether the content uploaded or disclosed has the “minimum journalistic-editorial content”!

conclusion

  • The case went to court and the judge ruled that the news outlet had violated the man’s privacy rights under the PDPA.
  • The judge also clarified the tension between press freedom and personal data protection and set a standard for what qualifies as news under press freedom: “Online publications can only be classified as news when they have minimum journalistic-editorial content.”
  • This means that any media outlet that claims press freedom and argues that they did not violate personal data protection laws must ensure that their uploaded or publicized content has “minimum journalistic-editorial content.”