Did the data commissioner get it wrong?
In the recent past some of us may have been enthralled by the antics of some “ladies” in a car park in Larnaca who put themselves in a less then favourable light, with abuse of a (non-Cypriot) lady, by reference to her nationality and stereotypical views of her role in the world, all of which was filmed by the victim of the abuse.
In the recent past the data commissioner put out a notice about Dashcams which could equally apply to the filming of the Larnaca show. In (Google) Translation it says: “My office has been receiving questions from citizens about the legality of using dashcams for purposes such as logging routes, recording other drivers’ possible dangerous driving and protecting their vehicle in the event of an accident, theft, vandalism, etc.”
To clarify:
- In Cyprus, on the one hand, there is no legal framework governing such processing. On the other hand, it is for the Court to rule on the legality of the presumption that in this case the camera will be material.
- The legal basis for processing (which includes the collection, use, storage and sharing) of images and / or audio from dashcams is the prior consent of the affected persons and, in the case of minors, the prior consent of the parents or of their legal guardians.
- Otherwise, in accordance with the provisions of Rule 5 of Regulation 679/2016, the processing of images and / or audio of third persons, adults and minors, without their consent, violates the principles of legality, purpose and minimisation, since:
(a) such processing lacks a legal basis;
(b) the videotaped / visual material is not collected for a specified, express and legitimate purpose;
(c) excessive, irrelevant and unnecessary third-party images are collected / recorded.
In the first paragraph she says there is no legal framework: then in the second she says that though there is no legal basis, one has to get consent. In the Third she refers to Rule 5 of Regulation 679/2016 .
This is the infamous GDPR regulation.
Now the plain fact is that on its own terms “This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity.”
As it is consent may not be necessary under GDPR as there are five other legal basis one can rely on, which includes “for the purposes of the legitimate interests pursued by the controller”.
Here as the data commissioner indicates that some people are filming the purpose of
“protecting their vehicle in the event of an accident, theft, vandalism, etc.”. which is I would suggest “for the purposes of the legitimate interests pursued by the controller” i.e. the person doing the filming.
That is of course not necessary when the filming is done by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity.
One therefore really has to question whether if the Commissioner gets it so wrong about the application of the regulation to private individuals engaging in data gathering for purely personal or household activity she is suitable for her role.
TE, Limassol
The post Did the data commissioner get it wrong? appeared first on Cyprus Mail.