Photographs as personal information
Photographs as personal information
Photographs, with identifiable individuals, contain personal information. In this case, when photographing and publishing such photographs, the privacy and personal data protection legislation should be taken into account. The most important piece of legislation on the protection of personal data is the General Data Protection Regulation (GDPR). Privacy and personal data protection are dealt with in a number of national laws and the Criminal Act.
Observing protection of personal data when taking photographs
Protection of personal data is taken into account when the higher education institution has a legal basis for both taking and publicising the pictures in accordance with Article 6 of the GDPR. At the same time, privacy must be taken into account. This is done by designing the photographing and the further use of the images in advance and by informing the data subjects, that is, the persons identified in the picture, in accordance with the privacy regulation.
Public occasions
At public events, information about the intention to take and publish pictures, for example in social media, can be supplied when participants are registering to attend an event. The registration must be accompanied by an explanation according to GDPR of the use of images of persons to be identified, which means that the report can always be used as a standard form of registrations to events. In this case, the taking and publishing of pictures is also planned in advance. At the event, for example, you can define a specific area of the venue for those who do not want to appear in the pictures. Another option, for example, is to arrange a photography booth were people are informed about the fact that images will be published on the organisation's website and on Facebook. In this case, it can be interpreted that the people who visit the photography booth have given consent to both the taking of pictures and publishing them on the web.
Photographs as personal information
The concept of personal data is defined in Article 4 (1) of the GDPR. Personal data refers to all information relating to an identified or identifiable natural person. Identifiable is a natural person who can be identified, directly or indirectly, in particular by identifying information, such as name, personal identification number, location information, domain name information, or one or more physical, physiological, genetic, psychological, economic, cultural or social factors. Thus, in certain cases, photographs may contain personal data.
When a natural person takes photographs of identifiable individuals in his or her personal or household activities (Article 2 of the GDPR), the GDPR does not apply but is limited only by for example the provisions of the Criminal Act. The situation is different if a natural person distributes an image taken in his / her private activities, for example on social media.
If photographs of identifiable individuals are placed on an open network, there must be a legal basis under the GDPR that allows personal data to be transferred to the service provider and which allows a service provider such as Facebook to process these data. For example, the higher education institution could deal with the pictures, depending on the situation, based on public interest (Article 6 (e)) or the legitimate interest (Article 6 (f)).
Legislation on the protection of privacy and personal data should therefore be assessed in relation to other fundamental rights and human rights such as freedom of expression. In general, a person who is photographed should be asked for his / her consent, but, for example, photographing a politician doing his / her job in a public place does not require permission from the person to be photographed, because his / her privacy protection is restricted by freedom of expression, the core of which is politics and public criticism.
Freedom of expression is governed by Section 12 of the Constitution of Finland, which states that everyone has freedom of expression. Freedom of expression entails the right to express, disseminate and receive information, opinions and other communications without prior prevention by anyone. According to HE 309/1993, p. 56, the central aim of the freedom of expression is to guarantee free public opinion, open public debate, free development and pluralism of the mass media and the public criticism of the use of power. Freedom of expression generally provides security for various forms of creative activity. In the provision, in addition to express and disseminate, freedom of expression includes the right to receive messages without prior prevention by anyone. In addition, the right includes the freedom to express and accept others’ expressions. The interpretation of the freedom of expression is governed by the European Court of Human Rights, which rules the interpretation of the European Convention on Human Rights.
Article 10 of the European Convention on Human Rights regulates freedom of expression. In HE 19/2013 pp. 14-18, freedom of expression must be weighed together with other rights and interests related to the situation. In accordance with Article 8 of the Convention, among other things, these include the right to enjoy respect for private and family life. Restrictions of the use of freedom of expression should be governed by law. Interference with the use of freedom of expression must also take place for the legitimate purposes referred to in Article 10 (2). In cases involving Finland, there have been verdicts concerning the dissemination of information or defamation in violation of private life, and the interference of freedom of expression has taken place to safeguard the reputation and rights of others. The European Court of Human Rights’(ECHR) main focus has become whether the intervention in freedom of expression, for example, punishment as required by the European Convention on Human Rights Article 10 (2), is indispensable in a democratic society. Indispensability refers to the pressing social need at hand. In its solution, the ECHR assesses whether the intervention of the freedom of expression was in relation to the objectives to be achieved and whether the reasons given by the authority to justify the interference were relevant and adequate. According to the ECHR, restrictions on freedom of expression should be interpreted strictly and there must be convincing evidence of their necessity. According to the principle of abiding interpretation, freedom of expression is the rule and the restriction is an exception. In its numerous judgments, the ECHR has stated that freedom of expression applies not only to positive, harmless or trivial information, but also to offensive, shocking or disturbing information.
When considering the limitation of freedom of speech, account must be taken of the context in which the message is presented. In addition to the internal meaning of the message, the evaluation is influenced by the context or discussion connection. In the interpretation context, the ECHR has given great significance to whether it is a core area of freedom of expression, such as politics or a marginal area such as advertising. Major issues of discussion in the ECHR's decision-making practice have been, inter alia, political debate, presidential election campaigns or debate on practices used in seal hunting. The ECHR has drawn attention to the following issues:
- were the facts presented in an objective way?
- were the facts presented in a misleading manner?
- was the image or information obtained illegally or legally?
- the position of a person: politicians, unlike individuals, are deliberately exposed to close scrutiny of their deeds and words; the civil servants are in the middle
- was the image a contribution to a generally interesting debate?
- was the article of general interest or did it only satisfy the curiosity of certain readers?
- was the information received from authoritative sources?
- was the information received from public sources?
- was the information already publicised?
- what kind of information was involved?
In Finnish law, it has been assumed that the limited status of privacy can only concern the person himself or herself but not his / her close relatives and friends. Publication of information about related parties and friends requires a legal basis, such as consent, in the General Data Protection Regulation.