Article 2 (2) (c) of the General Data Protection Regulation (GDPR) states that it does not apply to the processing of personal data “by a natural person in the course of a purely personal or household activity”. In a judgement before the Court of First Instance of Gelderland delivered on the 13 May 2020, this “household exemption” was explored further.
The facts
The case involved a dispute between a mother and her daughter over the publication of photos of the grandchildren. The daughter (plaintiff), a mother of three minors filed a claim in court to cease the posting of her children’s photos by their grandmother (defendant) on social media. The plaintiff argued that the defendant did not obtain a consent from her or her ex-partner who had now parental authority over the youngest of the children.
From April 2012 to April 2019, the child lived with his parents and siblings at his maternal grandparents. During this time, the grandmother had placed pictures of the children on her Facebook profile. Afterwards, the youngest child went to live with his father. The mother of the children had asked several times for the pictures to be deleted. The grandmother conceded to removing pictures of the older children from Facebook but specifically wanted to keep the photos of the youngest child, since she stated to have a special relationship with him since she had taken care of him for a longer time. The plaintiff also requested the defendant to remove an old picture of the plaintiff and her children from Pinterest.
The ruling
The GDPR protects the fundamental rights and freedoms of natural persons and their right to the protection of personal data. However, GDPR does not apply to the processing of personal data by a natural person in the exercise of a purely personal or household activity. The court ruled that although it cannot exclude that the placing of a photo on a personal Facebook page falls under a purely personal or household activity, in the preliminary opinion of the Court it has not been sufficiently established how the defendant set up or protected her Facebook account or her Pinterest account. It further stated that it was unclear whether the photographs can be found through a search engine such as Google and with Facebook it cannot be ruled out that photos may be distributed and may end up in the hands of third parties. For these reasons, the court ruled that it was impossible to establish with certainty that the posting of photos on social media fell under the “household exemption” in Article 2(2)(c) of the GDPR.
The Dutch GDPR Implementation Act (“UAVG”) stipulates that the posting of photos of minors who have not yet reached the age of 16 requires the permission of their legal representative(s). it was established that in this case, neither the plaintiff not the father of the youngest child, had given permission for the photos of the children to be posted on social media.
Therefore, given that the processing of plaintiff’s photos fell within the scope of the GDPR and given the lack of consent, the court requested the grandmother to remove the photos or else pay a daily fine of €50, up to €1000. The court also ruled that the defendant was prohibited from posting without permission photos of the plaintiff’s minor children on social media.
Assessment
Despite the headlines this case attracted on several news portals, it is important to note that the decision of the court in this case was motivated by the fact that it was unclear whether these photos could be found through a public search, and how the defendant set up and protected her Facebook and Pinterest accounts. Privacy settings on social media accounts are therefore highly relevant in determining such matters. It may be argued that had the grandmother put in place restrictions in terms of who could see the images, the outcome may have been different.
