Is it legal to own a photo of someone and spread it around without their permission? Backstory: My friends has a picture of me, which I asked him to delete and not show to people multiple times, but he keeps it and shows it to people no matter how many times I ask him not to. Is it legal to do that? More Info: I am the original poster, I just uploaded as a guest, so here's more detail: I am from England, I'm a minor (but so is the other person). By showing it to people, I meant sending them a copy. The picture is not intimate.
Copyright The photographer, not the subject(s) own the copyright in the picture. So, unless this was a selfie, you have no rights in the picture. Privacy If the photo was taken in circumstances where a reasonable person would expect privacy, then revealing it to others might be a tort of privacy breach. In most common law jurisdictions this area of the law is undeveloped. However, if the photo was taken from a public place (even if you were in a private place), or with your permission, this doesn’t apply. Intimate images In some jurisdictions, the distribution of intimate images without the permission of the subject is a crime. Intimate does not include a photo that is merely embarrassing. Bullying This is probably bullying behaviour but bullying per se is generally not illegal. It might be illegal if the bullying is motivated by a protected characteristic (race, age, gender, sexuality etc.) but that usually requires a context - employment, public accommodation etc. it might also be illegal hate speech even outside such an institutional framework. Similarly, within an institutional context like a workplace or school there might be policies around bullying; these might have the force of law but are probably quasi-contractural matters. However, a private person doing it because they don’t like you and want to humiliate or embarrass you is probably not doing anything illegal.
Posting such a pic and statement may give grounds for a lawsuit, but probably not Overview That is going to depend very much on the the jurisdiction, and on the specific facts. If the statement that the pictured person owes a debt is false, this may be a case of defamation, but that was explored thoroughly in Can you post a picture in your business to embarrass or defame a customer? and its answers. See FindLaw's page &quot;What Is Invasion of Privacy?&quot; for an overview of the classic privacy torts. See also this page quoting the Restatement (2nd) of Torts, § 652 See further the Wikipedia article &quot;Privacy laws of the United States&quot; which gives a history of the four torts. Note that not all US states recognize all, or indeed any, of the privacy torts. Nor do all non-US jurisdictions. In some places these torts have been recognized, or blocked, by legislation, in others by court decision. And in the US they are limited by the federal First Amendment's guarantee of freedom of speech. Right of Publicity,aka Appropriation There is, in general, no right to privacy in one's physical appearance under any of the standard privacy torts, except that if one's likeness is being used to advertise something, or imply sponsorship or approval of a commercial product, many jurisdictions protect a right of publicity (sometimes called the tort of Appropriation of Name or Likeness). But here it does not appear that the image is being used to advertise or promote or sponsor anything, so that would not apply. Intrusion upon Solitude and Seclusion The tort of Intrusion upon Solitude and Seclusion would only apply if the picture were taken on someone's private premises or somewhere else there the person had a reasonable expectation of privacy. Otherwise it would not apply, there is no general right to privacy for a picture taken in public. Private Facts The tort of Public Disclosure of Private Facts could possibly apply if the fact of the unpaid debt had been carefully kept secret, and if its disclosure would be highly offensie to a reasonable person. But nothing that is a matter of public record can be the subject of such a suit anywhere in the US, because under Cox Broadcasting Corp. v. Cohn, 420 U.S. 469 (1975) publication of facts derived from public records is protected under the first and fourteenth amendments, even against a specific state law granting protection. This will obviously not apply outside the US. False Light If the statement of the debt were true, but in some significant way misleading, the tort of False Light might apply. This is described by the Restatement of Torts (2nd) § 652E as: One who gives publicity to a matter concerning another before the public in a false light is subject to liability to the other for invasion of privacy, if (a) the false light in which the other was placed would be highly offensive to a reasonable person, and (b) the actor had knowledge of or acted in a reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed. Note that the standard of (b) above is the same as the &quot;Actual Malice&quot; standard for defamation cases where the plaintiff is a public figure. False light cases are in many ways similer to defamation cases, and some jurisdictions have treated themn as identical tro defamation, while otrhrs do not recognize them at all. Nothing in the facts stated in the question would imply a false light claim, but more context might possibly support such a claim,. Conclusion Nothing in the question clearly indicates that any privacy-based tort would apply, but the facts are stated it a very brief way in the question. Further context and detail might clarify the answer one way or the other. This answer is largely based onunited-states law, althoguh some of it will apply elsewhere.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
Working a mobile car cleaner now, my manager asked me to take some pictures before cleaning and after clearing, privacy issue of the car owner California law creates an expectation of consent for taking photographs of people for purposes of commercial distribution of the image to the public. California Civil Code § 3344. But, absent copyright or design patent issues (which would only very rarely come up since most people don't own the copyrights or patents to the designs of their cars, and the owner of the copyrights generally grants an implied license for the owners of the cars to display the copyrighted or patented designs), there is no parallel requirement of consent for taking photographs of things. Furthermore there is no common law expectation of privacy in anything that someone you do business with must necessarily see with their own eyes. So, if you must see the car to clean it, then taking photographs before and after the work is done does not violate any expectation of privacy to which the customer has not implicitly consented and does not violate any California or federal statute. Better practice would be for the business to explicitly have the customers consent in writing to the photographs, to remove all doubt. But the implied consent to having someone see your car when they are cleaning it would be unreasonable to deny in almost all circumstances. A company might voluntarily have an agreement to keep any photographs taken confidential and to have its employees sign non-disclosure agreements not to reveal what they see while working. If it did, this would create a legally enforceable expectation of privacy for the customer. For some VIP clients, this contractually enforceable discretion might be something that would induce them to pay a higher price for the same services. But those kind of protections are not the default standards of law that apply in the absence of an agreement. And, even then, taking photographs for purposes of internal use only would probably not violate an agreement of this kind. The work still requires that people inside the business, including remote supervisors, be able to see the cars to do their work.
Art. 15(4) GDPR says: (4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. In addition, Art. 85 GDPR requires member states to: [...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...] So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database). The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail. In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
The part about "If I'm the owner of the content, surely I have the right to request its deletion" is the problem. Sure, you have the right to request, but you can't legally compel. You have an agreement with them, according to which you got something, and they got something. You can't then take back the thing that you gave them, which is permission to use. You didn't give them the IP itself, which you still hold. Here's an analogy. You may own a car, and can give a person permission to use the car (let's say "if you bring me back a pound of cheese from the store"). You cannot later change your mind (especially after you've gotten the cheese) a say that you retract that permission and therefore they actually stole your car. When permission to use is given, as long as the conditions for granting permission are satisfied, you can't un-give permission.
One big hole in any scheme that relies on copyright is that it could not preclude people talking about the previous content or talking about you. This is well established First Amendment law. For example, see Near v. Minnesota 283 U.S. 697 (1931), which holds that except in rare judicially established exceptions (relating to military information, obscenity, and inciting acts of violence), government censorship is unconstitutional. Thus, no statutory scheme could be used to prevent third parties who happened to have seen the material while it was freely available from re-iterating what they had seen, or talking about it, or talking about the author (you). People could even reproduce portions of the published content. Some types of reproduction would be protected as fair use in the US, especially if the reproduction is for the purpose of criticism. (17 USC 107, and this previous Law.SE answer) The closest approach would be to protect your work as trade secret, making sure that anyone that you share it with agrees to non-disclosure. But, if you "publish unique content under this pseudonym" there is no way to "arbitrarily or wholly revoke discussion about that content". If the cat gets out of the bag, while you may have remedies against the person who violated the non-disclosure agreement, you would not be able to prevent third-party discussion or reproduction.
The answer depends in part what venue you're talking about, e.g. Reddit, Facebook etc. The details are revealed somewhere in the Terms of Service for that venue. The general pattern is that you are allowed to use that venue, provides you grant permission for the service to do what they do with your content. You cannot legally send them a take-down notice for your stuff, because a take-down notice requires you to say that the stuff was posted without your permission (and that is false – and you can be punished for making that statement). There could be a venue where they do not hold you to an irrevocable license, in which case you could revoke that permission (but not Reddit: you granted them a "royalty-free, perpetual, irrevocable, non-exclusive, unrestricted, worldwide license to reproduce, prepare derivative works, distribute copies, perform, or publicly display your user content in any medium and for any purpose, including commercial purposes, and to authorize others to do so"). I've seen a site that actually asserts ownership of user-contributed content (I don't know if their TOS ended up being litigated) – if is not at all hard to write a TOS that includes transfer of copyright, rather than granting of a license. The only hard parts are (1) figuring out what you want in terms of permission to use and (2) whether your answer to (1) means nobody will use your service. SE and Reddit TOS probably are as close as you need to get for what you describe.