Hacker News new | past | comments | ask | show | jobs | submit login
Grandmother ordered to delete Facebook photos under GDPR (bbc.com)
161 points by pseudolus 11 days ago | hide | past | web | favorite | 173 comments

Good! I don't post photos of my kids on the internet and I get so annoyed when other people take it upon themselves to post them for me. Clearview AI has made it even more clear than it already was that any data you give these companies can and will be used against you.

A family friend does the same thing with their kid, and I really respect that. I feel bad for them too, because I've been present for them asking other people to not take photos, and some of them start nearly frothing at the mouth about "PC culture" or "That's so stupid". My father takes photos of us without asking or saying anything at all, even if we're not looking at the camera at all, and will post that onto Facebook. It really bothers me and I'm glad to hear others agree.

My wife and I have the same opinion. So far, both sides of our family are complying to our wishes, except that one or two times my in-laws managed to put our kid in a Facebook story by accident - apparently the Messenger app is confusing enough that they don't even realize when it happens.

I wish people did not assume it's ok to upload photos of others to Facebook et al and were more aware about the implications.

We don't have kids but I do not want photos of myself posted to Facebook. Family meetings are always super uncomfortable. Some family members tell me in advance they will not upload the picture to Facebook but other people simply get upset with me.

The trick is to ban visitor smartphones and not to have an account, which is the only way to actually disable Messenger.

Which world are you living in where banning visitors having their phones is a reasonable thing to happen?

I think it is an over-reaction problems that stem from the fact there aren't established cell-phone norms yet.

Some people expect immediate replies to their text messages. This is a big problem with current teens, where their parents will demand this from them. But even some adults do this with other adults. Some people adapt to this by learning they need to respond to every message asap or else! Other people are more willing to treat phone messaging as something that is strictly asynchronous. I think most people are between these two extremes and vary on a case by case basis.

There also isn't consistent norms with how much phone use is acceptable in front of other people. Some tolerate nearly none (see the person you responded to). Some tolerate use motivated by the social situation (eg you look up something directly related to a conversation). Some tolerate only responding to VIPs (spouse, children). Some tolerate any kind of use as long as it isn't too much (I perceive this to be the most common, but it is also the vaguest). Some tolerate unlimited use (I've seen entire tables of people together at a restaurant on their phones the entire time).

One aspect that I find... disappointing is that an individual person's position on the first issue may not be compatible with the second issue. I know some people who would both demand only social motivated phone use when with others, but also demand immediate responses to their messages. To me these seem fundamentally incompatible.

There also doesn't seem to be a social custom of replying that you are with others and won't be particularly responsive for a while.

> One aspect that I find... disappointing is that an individual person's position on the first issue may not be compatible with the second issue.

The worst version of it that I've experienced is a person who unilaterally decides to grant themselves unrestricted use of the phone, while simultaneously demanding I stick to minimum/social-situation use only. This assymetry annoys the hell out of me, and I've had some heated arguments about it. I don't mind if someone is glued to their phone, but I expect to be treated no worse than the person expects to be treated themselves.

It is a common social custom in my circles to not use one’s phone when visiting the homes of others as a guest, a faux pas on the same order as bringing an uninvited stranger along as your guest in a visit to someone’s home.

Taking non-macro or identifying photos, especially of the residents or other guests, would be quite rude without advance permission.

I grant that many of my friends and associates may be more privacy-oriented than most, but it isn’t just tech/nerds-who-use-Tor.

I think it was a joke

In our case we send these photos to in-laws ourselves, and every now and then they futz something in just the right way to put one of these photos in a story.

Why isn't this between the mother and Facebook? Surely Facebook has some responsibility for posts on their platform. That also seems like a much more scalable as it can be part of flagging process.

Facebook really isn't in the business of intermediating domestic (or legal) disagreements.

hun? They aren't an intermediary. The pictures are posted on Facebook. They are the primary. It doesn't matter who uploaded them to Facebook.

Facebook is not in a position (and shouldn't need to be) to determine who has what rights to what images. They deferred to the governing bodies on this issue, and the courts decided that the parents had the right to demand the photo(s) are taken down. The parents could presumably now go to FB with this ruling and have them take the photos down.

If FB did not defer to another party, they would have to determine if the accusing party has the legal grounds to demand the pictures are removed.

How would FB know that those are the parent's kids? Or that the parents have custody? Or any other nuanced edge case?

It's best for everyone if FB defers to the bodies that defined these laws for judgement. Otherwise, you'll end up in a system like YouTube where copyright protections are easily abused against small organizations that can't fight back.

In the US, Facebook legally has to remove a picture of a child under thirteen if requested by a legal guardian. The sole proof required seems to be a check box confirming under threat of perjury that you are their legal guardian. And until your eighteen they have to take down any photos of yourself.

The only abuse case I can imagine would be online bullying, there's little financial incentive like in your YouTube example. And for Facebook, refusing a legitimate act could carry fines while deleting a pic involves little risk.

There is a big difference between "refusing a legal act" and refusing to act on unverified information. If it was a GDPR complaint, it should go through the GDPR courts. That's how the system is designed.

Deleting a user's picture incorrectly is absolutely a problem. You now have an avenue for malicious actors to effectively DDOS users by removing all of their photographs with these GDPR requests

>You now have an avenue for malicious actors to effectively DDOS users by removing all of their photographs with these GDPR requests

My entire post was just detailing the US system already in place, where they have the powers you described. These malicious actors could only target people under the age of thirteen, there would be little incentive to do such except bullying, and the culprit would like face punishment.

I would hate to see it happen to any child personally, but from Facebook's position there is no risk to them taking it down while leaving the picture up could carry a $40,000 fine.

How does Facebook know how old people are in pictures? I mean they invest a lot of time and money into AI, but I don't think they're there yet

By their Facebook account, it's the persons current age that matters. I don't know what they do if they don't have one, but I doubt many people without accounts would be targeted for an attack.

Ah yes. The most accurate and impossible to forge form of identification, the Facebook page

The account asking for the removal being tagged (having their listed dependent tagged,) in a bunch of pictures they want removed gives a pretty good hint.

This system has existed for all of Facebook's history, and doesn't seem to he a huge source of problems. It's abusable, but it takes a decent amount of work, the risk is rather high, and there is no payoff for abusing it. No matter how little we like the system, it functions fine

They're neither an intermediary nor a primary party to the dispute. Facebook is not an arbitrator. The case, as mentioned in the article, was between a woman and her mother.

You'd have to ask them or their lawyer why they pursued action this way. I suspect from the context in the article that it was a recurring issue, and the article mentions that it wasn't just posts on Facebook, either.

If all the parties had been in the US, a possible answer to that would have been section 230 of the CDA, which says that "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider".

That generally means that in the US unless there is some law that specifically says otherwise, this kind of dispute is between whoever posted the information and whoever wants it taken down. The hosting site can take it down on their own if they wish, but they do not have to.

Does Europe have anything similar to section 230?

Facebook has a form for removing pictures of children, the privacy standard I see limits it to under thirteen but I imagine that's based on local law.

I'd guess they went through the courts to prevent future pictures on Facebook or other social media sites.

this despite granny's TOS clause clearly granting perpetual likeness rights in exchange for periodic babysitting

I'm not surprised. Parents have ultimate authority over things affecting their children.

If Mom says no, why should Grandma be allowed to publically(!) post photos, for the whole world to see?

Edit: keep in mind that at least in my country you need permission from the person depicted when publishing a photo of him (with exceptions for important events, important people and so on).

And parents act in stead of the child, legally. When the parents say "no", legally the child has said no.

Agreed. My wife and I are both agreed that we want no pictures of our children posted online until they're old enough to make the decision for themselves. This is something we both believe very strongly since we've seen firsthand the inhuman way technology treats human data (we both are engineers).

However her mother does not respect our wishes and we occasionally find something she posted online or used when teaching a class. It's very annoying, but we just argue with her when she does it rather than doing something legal.

If Grandma were running around distributing fliers with the kids' photos on them, there'd be no controversy—that's weird, and of course the parents can ask her to stop, and if they ask, she should, and it was kinda crazy to do it in the first place.

Posting them on Facebook is exactly that but 1,000x worse, but it's "normal" so we have a debate about whether it's right for them to ask her to stop.

It's pretty common for grandparents to show and send people physical photos of their grandchildren.

Mine used to send them out to 250 of her closest friends every Christmas card time, and get them included in the church newsletter occasionally.

Via billboard? Published in the paper?

No idea why you'd be downvoted. Grandparents absolutely do not have the right to post pictures of their grandchildren without the parent's permission.

Happens in every GDPR discussion. Even when you post strictly factual information without any opinion, you get downvoted if you showed in other comments sympathy for the GDPR.

I live in the US, where laws are different than where you are. Can you help me understand: what happens if a child posts pictures of him/herself, against the wishes of the parent? Can the child be punished with the same fines as the grandparent in this case?

Obviously not, a child cannot be punished for what they don't understand. For "children" between the age of consent and majority it becomes somewhat more difficult; being a civil matter it would probably be down to a balance between the rights of the child and the wishes of the parent (which normally would be to the benefit of the child).

Probably not, except when anti-porn laws intersect with this issue:


So in this case, yes, a child can be punished for posting pictures of themselves, financially and worse. Otherwise (even in Europe?) I doubt it.

Well that’s in a sexual context which is pretty different..

Parents pay their children's fines. Why would they suit... themselves?

They wouldn't do it for the money — they would do it to force the kid to take down the photos.

I think the GP's point is that there's an implicit "or... what?" here. The parent would sue the child to either take down their photos, or... what? What would be the consequence if the child didn't comply with a ruling against them? The only potential legal consequences would be on the parent themselves.

In effect, the law has no leverage against children, except insofar as children can be influenced through their parents. If the parent were the one suing—because the parent also has no leverage—then nobody has leverage.

Parents usually have plenty of extra-legal leverage. That's why such a "case" wouldn't go to court, just as a dispute over the chaos in the child's room wouldn't. Application of that leverage is called "parenting". :-)

Yeah, that was my point. If a parent feels that they have to sue, i.e. if they feel the state's assistance is necessary to get their child to comply with their wishes—then that's because they're in a situation where parenting isn't working / they don't have any of their own leverage over their child "left."

And if they're in such a situation, then what do they expect the state to do? The state, in the end, only relies on their leverage. (Except in certain exceptional circumstances, like if a child is reported as being suicidal.)

I don't know elsewhere, but in Spain social services can take children from their parents if they're not being taking care of properly. And that doesn't necessarily mean that the parents are to blame. So if the parents can't control the children, they can tell government: we can't hold them anymore, their behaviour is antisocial and we can't take responsability if they commit a crime.

If the parents are unable to coerce the children without help from the legal system, they're expected to call social services to take over.

This is not a hypothetical case, older minors can overwhelm physically their parents (or grandparents, usual when parents are drug addicts) and sometimes the children are very difficult to deal, maybe they have a personality disorder.

Can a parent even sue an underage child that they have custody over? Wouldn’t that be suing yourself and/or your partner?

In US, if the child is under 13, they'd be covered by COPPA and it'd fall on the service provider. Can't answer for GDPR.


Forget all the family drama for a second, the headline is then

> Person A ordered to remove pictures of person B from facebook.

That's legal? That's not a blatant free speech issue?

(This isn't to say Grandma isn't being an asshole by posting them, but generally you have a right to be an asshole)

Edit: I just want to say I'm pretty happy with the discussion this post generated :) Also, it's been bouncing around from -4 to 0 points repeatedly.

Europe has very different legal traditions around free speech; it doesn’t necessarily work to map American understandings of free speech onto other countries’ legal traditions.

Besides, there are plenty of ways as an American I can force you to remove a photo without it being “blatant free speech” issue. Copyright and trademark come to mind, NDAs too.

Even the American notion of Free Speech spelled out in the First Amendment only restricts the government's power to censor speech. Private enterprise can censor anything it wants on its platforms, unless it comes under the jurisdiction of some kind of regulator. This is why it's so dangerous to democracy that so much political speech these days relies on unregulated privately-owned platforms.

It probably is a free speech issue. Free speech is not the end-all and be-all, in Europe at least.

Person A wants to put a photograph of Person B on facebook. Person B does not want their image on facebook.

Person A has a right to freedom of expression. Person B has a right to privacy. These two rights are in conflict in this case.

It's not that we're not respecting freedom of expression - it's simply not that absolute. It's that we're drawing the line between one person's rights and another's, and Europe often draws that line in different places than the US does.

But be clear - both A and B have rights here. The only way to be absolute about one person's rights is to disregard the other's.

Not all countries have legal frameworks that guarantee free speech, or with the robustness the United States does. You adhere to the law of the jurisdiction you operate in.

>You adhere to the law of the jurisdiction you operate in.

I think this is the best, most succinct summation of the global free speech and privacy issue.

You're free to not really respect the privacy of others, provided you are in a jurisdiction that allows you to do so. This hypothetical jurisdiction however, would not be Europe.

The GDPR have extra-territorial effect.

For example if you are in the US and operate a website in the US and get a visitor from the EU then the GDPR may apply to you with respect to that visitor.

The question is then one of enforceability but that's the reason why some American websites have GDPR notices or restrict access to visitors from the EU.

In Germany that's not only legal but the constitution considers this a fundamental right. https://de.wikipedia.org/wiki/Recht_am_eigenen_Bild_(Deutsch... (Link in german)

So in your couuntry you have the right to take photos of my kids and put it online because you are free to be an asshole? Really? Because I read about the fact that you can be forced to pay me if you want to use my image.

Would you say that if Grandma released a commercial documentary containing images of people that she hadn't gotten consent to appear in the film?

Likeness rights are likeness rights. Nothing to do with free speech. For IP law reasons, people don't have a right to distribute pictures with your likeness in them, unless you explicitly grant them that right. (If things didn't work this way, the modelling industry would collapse.)

In the US...

Commercial documentaries have images of people who didn't give consent all the time.

>For IP law reasons, people don't have a right to distribute pictures with your likeness in them, unless you explicitly grant them that right.

Of course they do. Every newspaper does it every day.

>(If things didn't work this way, the modelling industry would collapse.)

People can nonetheless charge for sitting for a photo shoot. And the use of images in marketing/advertising contexts (e.g. in an ad, in a company brochure) does indeed require explicit permission. You also get into publicity rights etc. of famous people.

But if I take a street photo of you and illustrate my blog with it or publish it in a book of my photos? I absolutely don't need permission for a photo otherwise obtained lawfully.

> People can nonetheless charge for sitting for a photo shoot.

It's more about royalties. The professional modelling industry (of any kind—hand models, for an unusual example) would be unsustainable if the only payment were direct work-for-hire. Models need to make money from downstream uses of their likeness, just like people who produce music need to make money from downstream sampling of their song. Otherwise, the most profitable position would become that of the "sampler" (who, after all, wouldn't need to license anything, and so would get their source material for free!), strangling out those who rely on original licensed material, and thus killing any demand for those who produce such material.

> Every newspaper does it every day.

The thing that journalists and documentarists are doing, in such cases (though not all—they often do license!) is fair use. And fair use is a defense, not a legal justification (i.e. it's like murder in self-defense, not like executing someone as part of your legal duties as a state executioner.) In other words, doing something under fair use does not protect you from getting sued; it just means you potentially have a good argument to use, if-and-when you do get sued.

Yes, oftentimes certain types of likeness rights are "obvious fair use." For example, a picture taken of a place, where that place contains a crowd—the photographer is unlikely to attempt to acquire likeness rights for anybody in the crowd. But technically, any one of those people could still sue for an infringement of their likeness rights.

Now, normally, such a crowd-member who sued wouldn't win... but if the person in the crowd was an "ex-celebrity" who'd gone into hiding and had made a statement that they didn't want to be in the public eye any more; and the paparazzist took the photo specifically because the ex-celebrity was in the crowd, with the intent of printing it out on the side of a building and highlighting with a spotlight just the little bit of it where the person is? They'd have a very good case. Even though it's still "a picture of a crowd, in public."

As well, you lose any notion of this implicit "obvious" fair-use defense, when you're no longer taking pictures of public places. A nudist beach, for example? Usually they've legally arranged to be considered "public-access private commercial facilities." You have no fair-use defense for pictures taken there, any more than you do for pictures taken inside a Starbucks.

A home is a private place. Grandma isn't taking street photos. In fact, without an explicit grant of rights, she's not just infringing upon the subject's likeness rights; she's surveilling private property. Just like most retail stores say you are, if you go in and take pictures of the shelves.

>That's legal? That's not a blatant free speech issue?

Why oh why does absolutely everything have to boil down to "free speech"?

Do you want to only have one human right? Free speech but no other rights?

People have the right to a private life as well as the right to freedom of expression and a list of other rights (the right to life, the right to a fair trial etc. etc.) and often these rights conflict.

In this case it's the right to a private life and the right to freedom of expression.

Neither right trumps the other, having both is important for society to function well.

And when the right balance between them is struck, actually having the right to a private life can protect the freedom of expression.

As an example: If one thinks anything and everything they say is _likely_ to be published publicly or to an authority that might then be prejudiced against them then they're likely to self-censor.

That's bad for free speech.

But if one has the right to a private life and is thus in control of what they say then they're less likely to self-censor.

There are limits on freedom of expression in general. Copyright is a fairly obvious analogy here.

In my opinion, there is no free speech issue. But I realize that American customs and jurisprudence see free speech in a vastly more expanded way.

In Europe we generally don't. In Germany we certainly don't.

We have a doctrine of "practical concordance" where all basic rights limit each other and have to be weighed such that all basic rights achieve maximal effect. In a way we're looking for a global maximum, not a local "free speech trumps personal rights" solution.

And on another note: I always find it rich when Americans complain about that. America specifically forged our constitution that way. Free speech was not very important post-war, when de-nazification called for banning books, closing all newspapers, licensing newspapers by publishers who were politically "right".

You got that right back then, I'm not complaining about that. But if you had wanted full American Free Speech in Germany, you could have implemented it with a stroke of a pen. Don't blame us now.

These photos are being deemed unacceptable after the fact. That's part of the issue. It was ok that they were taken and first published (apparently). So a major part of this issue is that someone continues to control a photograph based on their later decisions.

They are not alleging that the photos were taken against the parents' (or children's) will. It seems to imply that a person carries a perpetual license on their likeness.

Maybe that children are involved makes this case special (unclear here). Or maybe someone who liked a photo of themselves one day gets to demand it be taken down later. Imagine a couple dating put up a photo. They break up and a couple years later one is getting married and demands the other takes down that photo.

I don't think anyone in this thread was involved in the construction of the German constitution.

People are allowed to have opinions in opposition to that of the sitting government, including ones that sat well before we were even born.

>People are allowed to have opinions in opposition to that of the sitting government, including ones that sat well before we were even born.

Yes, but they need to justify them. Disregarding tradition goes both ways. You can't brush off the German conception of the law and then just go "well that's censorship bro", which is honestly 90% of the discourse on HN on these issues.

The notion of a 'concordance of legal values' is highly intuitive. There's a very strong case to be made that laws are not sacred, that they serve the public good, and thus ought to be balanced. It's the free speech absolutism that is purely an artefact of American culture, practised virtually nowhere else to this degree.

America doesn't have unconditional free speech either. It's illegal in many states to produce and distribute a pornographic movie. And even if it's legal, some practices are strictly forbidden because the state deems them morally wrong.

Absolute free speech is a flawed concept anyways and even America acknowledges that with the legal concept of hate speech.

Hate speech is free speech in the US. SCOTUS has ruled on this many times: https://en.wikipedia.org/wiki/Hate_speech_in_the_United_Stat...

Still leaves the pornographic movies. America doesn't have absolute free speech. Maybe the Supreme Court would strike that down, too, but currently you will be fined.

There are other instances like swearing on TV.

Pornographic movies are quite legal in the US. Heck, SCOTUS struck down the provision of the Communications Decency Act that prohibited knowingly transmitting obscene or indecent images to those under the age of 18. Their ruling was unanimous.[1]

The radio spectrum is regulated by the FCC. If you want to broadcast on it, you have to get a license and abide by the rules. The FCC has many rules about the content of radio communications including the frequency, the modulation, the maximum transmit power, and yes the content. For example: amateur radio & citizen's band communications can't be encrypted. But even when it comes to broadcast TV, some swearing is allowed. And you can swear as much as you want on cable or streaming services.

1. https://en.wikipedia.org/wiki/Reno_v._American_Civil_Liberti...

The advice I've seen given to American photographers, especially after a blowup over pictures, is that if you photograph a crowd, you don't need a release (it would be unreasonable to expect you to track down everyone in the picture). But if you photograph a subject or small group, you're supposed to ask if you can, and if you're doing it for commercial purposes in particular, you should just have a model release form handy and ask them to sign it on the spot.

Yes, that's legal. The American belief in free speech trumping almost every other consideration is not shared by all countries.

The photo of a person is not free speech.

Depends on where you're at, but in some places it is.

photography can easily be considered art.

By upending the ruling it would conversely be a right to privacy issue. The American system values speech over privacy when they conflict, but some but in other countries, the preference might be for privacy. As a European and as someone whose family lived under communist rule, I think it's totally valid to favor privacy of the individual over the rights of someone to publicly disseminate their personal data against their will. Europeans were closer to the effects of the secret police forces and the mobs that enabled their rise to power.

Isn't freedom of speech about being able to debate ideas and have different opinions? I don't see how that relates to this.

And the thing that matters isn't mentioned by BBC?

Was it a public post or private?

BBC doesn't even seem to understand the issue at hand.

Public/The court didn't know - http://ipkitten.blogspot.com/2020/05/privacy-rights-and-soci...

First, facebook can stil datamine that photo even if it's not public. Second, if it were private, gradma would still be sharing it with people outside the control of the parents (what if gradma was dating a pedophile?). Third, gradma could've easily changed them to public any time.

> First, facebook can stil datamine that photo even if it's not public.

This is not relevant to the article, why can't we just talk about the article. There are plenty of other articles on HN about privacy within applications.

The court specifically mentioned the 'general public'

"The court acknowledged that "it cannot be excluded" that placing a picture on a Facebook or Pinterest page might be exempted from GDPR scrutiny on the basis of this provision, but held that it had not been established that A's pages were inaccessible to the general public."

When you publish on Twitter or Facebook publicly you are no different to a newspaper, you are publishing to the public record.

The BBC clearly doesn't get this, which I assume means a lot of the general public doesn't either with such lousy media.

How can I explore photos that people I've blocked have uploaded, and get facebook to remove them? Seems like that should be possible.

> How can I explore photos that people I've blocked have uploaded, and get facebook to remove them?

Why do you think you should have the right to review the photos that other people uploaded, whether or not you've blocked them?

Oh, I would restrict to photos I’m in

Good. I hope people do not feel I am being overtly critical, but deleting the photos mean nothing. Once something is posted on the internet, especially Facebook, it can not be un-posted. At least, that is what my understanding is.

You're not wrong in the sense that things get cached, mirrored, scraped, etc, and probably live forever inside Facebook's datacenters even when "removed", but there is still a valid case for not wanting the pictures posted on a public profile for all eternity.

This is exactly the point: it being in FB’s “big pile of everything they’ve ever seen“ is entirely different than it being publicly available.

And therefore there is a purpose to having it taken down.

>Once something is posted on the internet, especially Facebook, it can not be un-posted. At least, that is what my understanding is.

But in the thread next door everyone is screaming that social media companies have complete, absolute and unchecked power over all forms of human communication and expression, and that when someone is deplatformed or their channel is banned, they and their content are all but permanently erased from human society.

Does this mean that, broadly, under GDPR if anyone in any photo you've ever taken and put on social media complains, you have to take it down?

Or is this because the subjects are minors? Or some other technicality, like whether or not the photos were taken in a public place or similar?

I think being asked to stop distributing magazines with people's photos in them, when you didn't get prior permission to publish them, is reasonable.

That people are so casual about what they post publicly online is nuts. That sites that exist pretty much solely to enable that bad judgement keep operating is nuts.

I'd have to disagree with that. The press shouldn't need permission to engage in photographic journalism. The restrictions we place on them should be very narrow and specific.

The key point is balancing the rights when they are in conflict.

There's obviously more weight put on the freedom of expression side of the argument when it concerns journalistic endeavours than, say, a grandmother wanting to post pictures of her kids.

Germany has exclusions for persons and events of public interest. So journalists can still do their job.

The "public interest" is often a very politically sensitive subject to define. While I'm sure that works great 99% of the time, is that last 1% worth the sacrifice?

Personally I prefer the default to be legality, and make exceptions for things we want to be illegal, rather than reverse.

Journalism is in many ways excempt from the gdpr (although it does vary by member states IIRC)

There's a public interest exemption, so of it's news you might be in a stronger position. But yeah, generally.

When FB first had tagging and there began to be problems with people not wanting pictures of their topless beer-bonging to show up on Grandma's wall, I thought a good approach would be that all pictures with multiple people should only be visible to those who are tagged in it until everybody is tagged and everybody consents to public display.

Yes. People can coerce you into taking down their PII, including photos, in Europe. (Assuming they know of it's existence on your social media account, never gave you permission to use it, and object to it being made available.)

But I know some people who believe that a workaround involves both you and the information being physically in the US, and the information not actually being displayed anywhere in Europe. I don't know if such a case has actually been litigated, but I'd wager you'd be OK in that scenario.

It's more nuanced. If it's in a public place and not invasive (eg taken through a street window) you have little case to get anything taken down. So no stranger appearing in your Disneyland pictures can force you to delete them.

It is more complicated than that.

See https://en.wikipedia.org/wiki/Google_Street_View_privacy_con... for issues that arose in practice from pictures taken in public by Google.

If I post e.g. the Eric Gartner video[1], can the involved officer force me take it down based on his privacy rights?

[1] https://www.theguardian.com/us-news/video/2014/dec/04/i-cant...

Art 6 (1) (e). You may have to fight but you'll win. IANAL.

> (e) processing is necessary for the performance of a task carried out in the public interest

Right, so it’s not as absolute as the original comment made it sound.

The full nuance of the law can only be gleaned from the law itself. Any shorter comment on the Internet is guaranteed to leave out one of the meanings. So, yes, I think you're right but that's always going to be the case.

Fair, but IMO there’s not even a hint of nuance in the original comment. Even a “It’s complicated but...” would be better.

Fair, fair.

This should be the disclaimer put on every discussion of the GDPR on here, to be honest

"Coerce" has a negative and unlawful connotation/definition. There is legislation for this so it's basically a lawful request for removal.

This is an interesting problem. I typically don't post pictures of other people; though I don't generally ask I don't do it if I think the person might not be happy with it.

But the way GDPR is written someone could come back years later, having changed their mind, and have a picture taken down. Perhaps a couple broke up and one party wants all photos with them together removed. I suppose that's OK, but implies a kind of curation (and an obligation) that isn't always easy.

The second is random passers-by who appear unintentionally (by all parties) the background of photos. On one hand, what expectation of tangental privacy should you have when you're out in the option and people can see you with their eyes? On the other hand, permitting this seems like it would open a mass surveillance loophole.

I can imagine a relatively easy fix for the latter, which is an automatic blur filter for those who aren't the "subject" of a photo, similar to what street view uses.

> Does this mean that, broadly, under GDPR if anyone in any photo you've ever taken and put on social media complains, you have to take it down?

It goes against what we've been used to on-line, but it does make sense. Even without GDPR, I'd say basic manners would oblige you to take a photo down if a person featured on it asked you to.

>"Does this mean that, broadly, under GDPR if anyone in any photo you've ever taken and put on social media complains, you have to take it down?"

We can only hope. No one has the right to post a picture of me on the internet anywhere ever for any reason.

This is silly. You don't retain any claims on images just because they include you. Extrapolating this idea leads to absurd conclusions.

If I take a photo of a crowd at an NBA game and publish it in a book of NBA photos, should any member of that crowd be able to force the publisher to stop selling the book until they've removed the photo? If not, why should it work differently on the internet?

Laws are different per country but usually it has to do with the intent of the picture, if I'm in background of your NBA photo I'm not the main subject so it's ok and I have not right to ask you to take it down.

Again, only speaking for my country (but I'd expect other European countries to be similar):

pictures of a crowd don't give individual people depicted any rights, unless they are somehow the focus of the picture (say portrait shot with a crowd in the background).

Also, when you take a photo of a building the passer-by doesn't get rights to demand you not publish it, if he is merely an insignificant chance addition.

Unsurprisingly, all those "easy edge cases" that internet commenters believe to have found as the first person ever have already been thought through and handled.

Not to be a stickler, but if you’re at an NBA game you contractually agree to allow that photo to be taken and displayed (under US law). Obviously it’d be different under EU law though.

GDPR consent cannot be a condition of accessing the service. It also has to be revocable.

That’s why I put in the disclaimer. I don’t think you would rely on consent in that instance. Probably would have to use the “legitimate interest” and have some rules around how photos are taken and used (e.g., people in the background where the soccer player is the target of the photo vs taking a photo of a single fan in attendance).

Does anyone know how EU sports handle this? Do they blur faces of people in the crowd on request?

It would be a terrible solution if they did that I hope they don’t). I imagine they have specified what the legal basis is for collecting and using the photos and have an exemption outlined for when they receive a deletion request.

In the UK there's the common law notion of a "reasonable expectation of privacy".

If you're in public then you don't, generally, have a reasonable expectation of privacy, but if you're at home or at work then it's a different story.

As far as I'm aware, though, this hasn't been tested in court since the GDPR has come in to effect, but I would be surprised if the (UK) GDPR is not interpreted with that principal if and when it does.

Umm, what if I take photos in a public place with you in them and the laws of the country allow public photography? or posting images which are public record such as mugshots/booking photos? (not that I agree with them being public record anyhow, morally I'd agree with you but it would be perfectly legal to do so)

> Umm, what if I take photos in a public place with you in them and the laws of the country allow public photography?

Here in Germany you are allowed to take photos in public, but you may not publish them in all circumstances. If a person is somewhere in the background it's fine. Also if it's a person of public interest. But you can not just follow anyone in public, take photos of them specificially and publish them. You may be required to take them down. Personality rights exist even in public.

> or posting images which are public record such as mugshots/booking photos?

In Germany (and many other countries) mugshots are not public records.

Depends. Public in the sense you want to photograph some monument/building? Then no problem.

Photographing in public for the sole purpose of taking a photo from you? No.

In the US, if you're in a public place you have no expectation of privacy. Someone can take your photo and do whatever they like with it. (This also goes for photos of "private property" that is visible from a public location, which often comes as a surprise to security guards and law enforcement).

Honestly, I feel kind of the same way and i'm not really a big fan when I find pictures of myself online I didn't know about, but it's fairly unrealistic to believe you can stop people from doing this.

Nothing was stopping people from taking your picture and posting it around town, or in a classified ad or something before, nothing's going to stop people from doing it now.

The best thing to do is decide if it's a picture really worth being upset about existing and if it is, kindly talk to the people who posted it, otherwise it's probably not worth worrying about.

I agree with the sentiment, but for most of history there has been some sort of ceremony when taking a photo, saying cheese for example, it used to be much more obvious when a photo was being taken, and now its discrete in many situations.

People that knowingly smile for a photo aren't really the people complaining.

> The best thing to do is decide if it's a picture really worth being upset about existing [..]

What if you've not seen the photo, don't know who took the photo, or who posted it, or where they posted it?

Last year I had a drink with a group of friends in a pub, commemorating the untimely death of a friend one year before.

The following day, at work, a manager who wasn't present the night before asked me about the event the previous evening. He said he'd seen me "in the photos" on Facebook.

I'm not on Facebook, so I've no idea who took - or who posted - photos.



Decide whether it's worth worrying about and if not, don't?

Was your boss angry about it? Or were they just making conversation about it?

One of those is worth worrying about, the other may be annoying but doesn't matter.

You can't control people. I dunno, even before everyone had cameras on them all the time I was taught to assume everything I did in public could be seen and maybe even be recorded by anyone, my dad was a bit paranoid, he taught me this as a child long before cell phones became ubiquitous. It's just the way it is. If you're in a public place, people can see you, people have cameras, the internet exists.

Again, I agree, I dislike pictures of me existing randomly, I try to avoid it. I'll dodge cameras and shit if I see someone taking pictures. But I know, inevitably, there's not much i can do about it. But I also realize, people tend to have short attention spans and memories and live in their own worlds so in the end it doesn't really matter and most people don't care enough to remember some random picture they seen of me anyway.

With companies assuming right to use the pictures posted on their platform it is now more complicated matter.

Would you like picture of you posted by your family member on company's X platform to be used by company X for marketing purposes? I get your family member may not mind if their own pictures are used but you were never asked for permission. Would you want to be asked for permission?

The verdict [1, Dutch] is somewhat less interesting than it seems since it was a summary proceedings with both lawyers (and the judge) not really versed in GDPR and due to covid quite limited interaction.

The grandmother could have argued legitimate interest (she is a grandmother and took care of one of the children) and have demonstrated limited visibility (now there was no mention of posting publically or not, so the judge went with publically) and the case would have started to get interesting.

Now it was just a slam dunk. No permission, no argument for use case under GDPR, done.

[1] https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:...

What specific Legitimate Interest necessitates processing of personal data in this particular case? Taking care of the children? If there's a way that she can reasonably accomplish that without posting to Facebook, then it's not covered by Legitimate Interest.

She doesn't have to argue that the utility exists for some practical purpose like babysitting - she would only need to argue that the pictures were taken by her, and that she uses them personally to look at the images of her grandchildren for her own personal happiness (which has utility).

The Legitimate Interests basis for processing personal data is a qualified one, though:

>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

So where there is any doubt one must test the idea that the data subject's rights outweigh one's legitimate interests.

I admit the purpose does not have to be practical. But the principle of Data Minimization still applies. If she can personally enjoy the pictures without posting them to Facebook, then that purpose does not cover posting them to Facebook. It probably would cover cloud back-ups that don't share with other people.

My overall point is that simply claiming "Legitimate Interest!" is not a free pass to do whatever you want.

Which demonstrates how easily such laws are abused even when they don't technically apply. How much money and time are grandma willing to invest for the sake a few pics? How much less likely is she to post more? Whatever the benefits and details of the GDPR its chilling repercussions are non trivial.

The "chilling repercussions" of making illicit publishing of personal data illegal?

That is the whole point of privacy laws! It's like saying that laws against theft cost you so much money since they make you pay in the supermarket.

There is a long tradition of grandmothers showing pictures of their grandchildren. Is that now banned or does it require prior notice in writing by each child? Does she have to wait until the child is an adult and can provide legal authorization?

Showing pictures in a personal scrapbook != sharing them with a third party (Facebook) and (depending on the privacy settings), potentially the entire world. Further, the digital nature of the photo means that any person on the internet viewing the photo that grandma is "showing" can download it for personal use, whatever use that might be (including illicit).

An analogy in scrapbook terms would be if grandma walked into a public square and put photos of her grandchildren onto a billboard, and every person who walked up to see them can peel off a copy, with no limit to the number of copies that can be peeled off this way.

I was a nudist at home with my parents and sometimes other family members. I didn't like naked pictures of me being shared with strangers.

I was comfortable being naked around people I knew and trusted.

My grandparents didn't always give a shit about my comfort levels and shared pictures of me in various states of dress with others.

I think I should have a clear and cut right to decide if I'm comfortable or not. Especially when I voiced those concerns as a kid.

They would not however post it in newspaper and they would not stick it to common board. Showing it in public and showing it to few friends is different.

Also, few years ago, grandma needed to be given picture by parents. She would not snap picture parents did not wanted, because cameras were not something you normally have with you all the time.

It requires the grandmothers remove the pictures when requested by the child's guardian.

I’d argue there is a long tradition of grandmothers showing pictures of their grandchildren to a limited audience in the form of physical photo albums.

The internet is relatively young; there is no “tradition” of grandmothers posting pictures of their grandchildren on Facebook publicly (not just to “friends”).

Online privacy is an entirely different beast. The world is still iterating on how to deal with it.

To an unrestricted public?

I have never heard of the long tradition of grandmothers publishing their grandchildrens' photos in a newspaper or handing out photo leaflets.

They usually show those pictures to a few friends. In person. In their photo album at home.

(The GDPR doesn't cover that, obviously, because it is meant to address the rather new phenomenon of world-wide audiences)

The headline of this is so clickbaity in making it sound like some little old grandma posted pictures of her vacation and big evil government made her remove them.

She posted pictures of grandchildren against their mother's wishes. She's just being selfish, and the fact that she's a grandmother isn't really germane to anything.

The description of the defendant as "a grandma" is definitely meant to get you on a particular side of the story before even reading it.

She's not called "a grandma" which is folksy and so you would be correct.

She's referred to as "grandmother" to indicate the relationship which is relevant to the story and the presumable toxicity of the situation.

It says the complaint was made after they fell out - I agree she should take them down, no question.

But the story could be read as the daughter spiting her mother by making her take down photos she was happy with before the fall out.

I'm not claiming that's what happened - maybe they fell out because of this - just saying we shouldn't rush to judgement on her motivation for pushing back.

I disagree, the detailed headline helped me to predict the story correctly. Her use of Facebook as a grandmother was very typical and the disagreement one I'd heard before.

It'd be irrelevant if she was posting data she'd got e.g. from her job.

I agree that the grandmother should respect her daughter's wishes and take them down.

I would disagree that it is the role of the government to enforce this.

eh. I thought both the article and the headline were fair.

> The woman must remove the photos or pay a fine of €50 (£45) for every day that she fails to comply with the order, up to a maximum fine of €1,000

Does that mean you can just write a check to not be covered by the GDPR?

I imagine that would very quickly turn in to contempt of court.

Yes, but you’d better have a big checkbook: willful violations of the GDPR scale up to 4% or €20m of annual global revenue - whichever is higher.

What's grandma's global revenue?

In most cases, less than €500M.

A question every family should be asking...

> Does that mean you can just write a check to not be covered by the GDPR?

Does that mean fines are checks you can write to not be covered by the law?

Am I the only person to think that even parents should not be able to post - for anything other than a transient period (maybe not even that) - photos of kids in a public web space?

It has always seemed obnoxious to me, the choice being made on somebody else's behalf to consign their privacy to the dustbin for eternity through this method.

Social and legal norms give parents astonishingly broad powers over their children's lives; this is indeed an important decision, but not any more important than the other things parents can decide uni-/bi-laterally.

Who took the pictures? In a sane legal system it would boil down purely to who owns the copyright, barring an exceptional circumstance like revealing medical information. This privacy stuff has gone to absurd extremes. Soon it will be illegal to say someone's name without written permission over there. What a crazy legal landscape Europe is.

In many European jurisdictions people have a 'right of their person to their own likeness', meaning that publishing pictures requires consent.

This seems like a straightforward application of this, and more importantly gives the children power to control what information of them is on the internet.

The European legal landscape is perfectly fine and gives children the right to put a limit on what their (grand)parents can do with their image. It protects the privacy of children, which honestly shouldn't even be controversial.

> Who took the pictures? In a sane legal system it would boil down purely to who owns the copyright, barring an exceptional circumstance like revealing medical information.

So I could just follow you around taking pictures of your face, kids, family, work, house, car, and then post a big beautiful album online since I would have... the copyright? You're ok with that, right? What a crazy legal landscape the US is.

Essentially, yes.

> This privacy stuff has gone to absurd extremes.

Maybe you don't care about it. But others do. And laws are for protecting everyone. There are lots of factors involved and many aspects to consider. Your conclusion of a "sane legal system" with only one exceptional circumstance "like revealing medical information" is just trivial and naive.

> In a sane legal system it would boil down purely to who owns the copyright

Nope. Most countries have rights of image/personal rights in their laws

If the grandmother took the pictures she would have copyright over them. But the GDPR isn't concerned about copyright but instead the handling of personal data. I don't think it's a stretch to consider one's photo to be personal data.

Social media sites are mined for photos to be used for facial recognition apps. While you're concerned about the slippery slope of being able to post what you want online, companies and individuals right now are using your photo in ways you probably didn't imagine. I don't think it's clear cut.

What on earth are you on.

My picture is mine. Not the person who took the picture.

I hate family members who think they're somehow entitled to me and my body and my face. Like no. I will be the person deciding what I'm comfortable with.

In the US and presumably many other jurisdictions, that's not true. The owner of the copyright of the photograph is the one who took it, not the subject of the photograph, baring pre-existing contract arrangements. There are limits, but generally speaking if a photograph of an individual is taken in a public space it is owned by the photographer.

This is the legal regime that enables a lot of journalism, good and bad.

And now we see a change in the legal definition per GDPR.

GDPR doesn't affect the legal definition in the US or other non party jurisdictions. It has a pratical effect because few businesses or hosting platforms can avoid doing business in the EU, but the copyright regime in the US remains the same.

Sure, and now you see how laws actually impact people outside of their borders.

The US has been the driving force behind this before, times have changed.

So do you just have a problem with people posting photos of you on social media, or even just having photos with you in them for their own memories? It seems like your critique would apply equally to both.

Their memories die with them. Social media doesn't.

I'm glad to see EU taking the necessary steps here.

Do you go around projecting your memories on a public display accessible to anyone, any system, any algorithm, any time, possibly forever?

Not personally but some people do and it's their right to do so. It's basic right of expression.

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact