Dublin Data Sec 2019

30th April 2019, RDS Concert Hall, Dublin

Data Sec

Adrian Weckler: Common sense needed to balance privacy laws with camera phone posts

Ireland's Data Protection Commissioner Helen Dixon at the launch of her office’s annual report 1 Photos
Ireland's Data Protection Commissioner Helen Dixon at the launch of her office’s annual report

'Excuse me, you're not allowed to take that photo."

Ever get tapped on the shoulder at a football match, a communion or in a public square?

Every day in Ireland, millions of photos are taken and posted on social media. But there's growing confusion over when and where people are legally allowed - or forbidden - to take those snaps or post them to social media.

At issue is consent: when do you need someone's consent to take a photo of them? Does it matter whether they're alone in a photo as opposed to being in a group or a crowd? Perhaps most critically, what is the law around posting photos of others on social media?

This week, I had the chance to ask Ireland's Data Protection Commissioner, Helen Dixon, a few questions about where privacy law stands on this issue.

To make a long story short, it's pretty patchy.

According to the data privacy commissioner, you are allowed by law to take a photo of someone in a public place on a phone or a camera, provided you're not harassing them.

"In general terms, taking a photograph of someone in a public place is similar to observing a person in public," said Dixon. "You can take a photograph of an individual in a public place."

So far, so clear. But it all starts to become a little more legally foggy when you go to post that photo somewhere online.

"As to whether you can publish it to a broad-based audience is a different question," said Dixon. "If you're interested in artistic shots and you want to publish those artistic shots of individuals you observe on the street to a broad-based audience, you would need to seek the consent of that individual. On the other hand, if you took such a photograph but weren't circulating it widely, then you may not need the consent."

What does "broad-based" mean? Does this mean Facebook?

"To some extent it may depend on the context in which you were publishing it and the type of group your friends on Facebook adhere to," she said. "But in a general sense, I think if you're publishing it beyond what would typically be the household type exemption under the legislation then you'd want to be careful that you're not acquiring the position of a data controller that has obligation to legitimise the processing and publication through consent."

There is a basic, personal allowance that Irish privacy law gives in this regard. According to data- protection law, restrictions generally don't apply to "personal data kept by an individual and concerned only with the management of his personal, family or household affairs or kept by an individual only for recreational purposes".

But even here, there isn't really any further clarity. What constitutes an individual's "recreational purposes"? Does that include maintaining an Instagram or Flickr photo account? If so, is there any difference in the competing rights of the photo-taker and photo subject if such an Instagram account has five followers or 5,000?

According to Dixon, "common sense" is a critical, if undefined, factor here. Part of its application, she believes, lies in common courtesy. So if you publish a photo and someone contacts you to request that you take it down, it might just be good practice (as well as manners) to take it down.

Nevertheless, people's idea of common sense differ according to their interests and sensitivities.

"They might be different but you'd generally be led by the data subject at issue in a lot of circumstances."

So if the photo-taker refused to take a photo down from their website and the person photographed contacted the data protection office, what would the office do or say?

"We'd have to look at all of the circumstances," said Dixon.

So there's a possibility that the office might tell the photo-taker to take the photo down?

"There's a possibility that we would recommend you take it down," she said.

On pain of what, though?

"On pain of continued correspondence from us on the subject. But look, the point I'm trying to make is that data protection law is not always useful for regulating the behaviour of individuals. Its primary focus is about large data sets, so it's about monitoring on a large scale. And while it may apply in individual circumstances to a person on a street that you photograph, the role given to regulators and the way the law applies really does need to involve common sense."

In the absence of watertight rules defining about what can or can't be done with a cameraphone, we're left with competing interests of privacy and expression. Which will prevail?