If photos are PII under GDPR, how are most photos on the web legal? It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal and the most identifiable form of data available. Many sites not only collect and process photos, they publicly distribute them. These range from major multinationals, through international academic organisations to small clubs. I am probably on all 3 of these, and have not knowingly given any consent for my face to be distributed around the world. What is the legal situation with this? Is it just that this has not yet been challenged so is not proven illegal? Is there some exception for this sort of data? Is there something I am missing?
What many people miss in relation to GDPR is the other five lawful bases for processing - there's a lot of discussion about consent, but this is only one lawful basis of six. The full list from Article 6 : Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Arguable bases would include performance of a contract or public interest, though there's also room to argue whether legitimate interests of the controller are, or are not, overriden by the subject's fundamental rights and freedoms. The short answer is it's not just about consent, and press and social media sites are likely to have covered themselves with their contract or with a public interest argument.
If the website's processing of your personal data is within the scope of the GDPR, then you have a qualified right to request the erasure of your personal data. It is relevant whether: the website operates within the EU; the website is operated by a company established in an EU country; the website aims to sell goods or services to people in the EU; or the website is routinely processing the personal data of people in the EU (including non-citizens). Furthermore, it is relevant whether your posts: contain one or more identifiers from which you could be personally identified, directly or indirectly, including by only the administrators or owners of the website; and by their content, directly reveal information relating to you. For example, let's say you posted on a forum saying that "I am a keen supporter of socialism", and your personal email address was used to sign up to the website, then you would have revealed information about your political beliefs, which by reference to a username, the website owners could use to uniquely identify you by your email address. You would not necessarily have to have used your name. If, for example, you posted something factual, like, "The Porsche 911 GT2 RS MR recorded the fastest lap time for a road-legal sports car on the Nürburgring," then it is only personal as long as it is associated with an identifier through which you could be identified. As such, the removal of the relationship could easily anonymise the post. A data controller has an obligation to provide means by which the data subject can exercise the rights guaranteed under Chapter 3 of the GDPR. Article 17 grants the right to "erasure of personal data concerning him or her without undue delay" where the grounds under Art. 17 lit. 1 (a) to (f) are met. It may be relevant what the lawful basis of processing personal data was in the first place, such as in determining whether you can withdraw consent (i.e. you cannot withdraw consent if consent was not given), or in determining whether there is a right to object under Article 21 lit. 1. Derogations permissible under local implementing laws may provide for other exemptions or requirements to the right to erasure, so it is also important to determine the country of jurisdiction.
There are various tangential ways in which this could be illegal, for example if your subjects are celebrities, you take a picture of them and commercially exploit it without permission in a product endorsement. Leaving aside such fringe cases, in the US, the legal right to privacy comes about, at the first cut, by premise trespass law. If the proprietor tells you to go away, you have to go away; if the proprietor tells you that you cannot take pictures, you cannot take pictures (your right to enter is conditional). Neither of those circumstances holds in your case. There are other tort-law bases for a right to privacy: numerous privacy laws regarding privacy and financial transactions (not relevant here), the aforementioned right of publicity (commercial exploitation of likeness), false light (like defamation, about creating a false impression – I don't see what false information is conveyed by a photo). There is also public disclosure of private fact, but that cat is out of the bag because the subject has self-disclosed the supposedly offensive fact revealed by the picture by eating in public. Intrusion of solitude and seclusion does not exist in the circumstance, since the subject is eating in public where everybody can see: there is no reasonable expectation of privacy. This page sums us Virginia law. The main take-away from that is that there is no common law action for privacy in Virginia, and only an action for unauthorized used of likeness or name.
If you merely provide software for your client to use, you are not processing personal data on behalf of the client. But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor. Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution. Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).
If you process any personal data, you do need to provide notice to the data subjects per Art 13 or Art 14 GDPR. Personal data is any information relating to a (directly or indirectly) identifiable natural person. It seems you are processing personal data including as addresses, PayPal accounts, and IBANs. Thus you're in scope of the GDPR. The GDPR does have an exception when data is processed for “purely personal or household purposes”, but that very likely does not apply to you. The German Datenschutzkonferenz (DSK), a cooperation of the German supervisory authorities, has published a handout on information obligations, listing which information has to be provided in a privacy notice: https://datenschutzkonferenz-online.de/media/kp/dsk_kpnr_10.pdf Such a privacy notice can be fairly short if you're don't doing anything special, in particular if you only use the data as necessary to fulfil the sale contract and then as legally required (e.g. for keeping financial records). There are privacy notice generators that can help with the boilerplate, but be aware that some are significantly outdated, and that in any case you have to fill in the information about your concrete processing activities. You have guessed correctly that you will need to inform your customers about your data retention periods. Your privacy notice will get more complicated if you also want to use this data in other ways, for example for marketing purposes. That would also require you to think about appropriate legal bases (e.g. legitimate interests, or consent).
The relevant law in England and Wales is the Protection of Children Act 1978. Under section 1 of the Act, it’s a defense to distributing, showing, or possessing indecent images of children if you had a “legitimate reason” to distribute, show, or possess them. It’s also a defense if you had not seen the images, didn’t know they were indecent, and didn’t have any cause to suspect they were indecent. However, the 1999 case of R v. Bowden held that downloading a digital copy of an image counts as “making” an image. This is not subject to the “legitimate reason” defense by statute (although I don’t know if it’d count as “making” if you have no reason to know the contents, like if a computer repair shop backs up a customer’s hard drive without looking at what’s on the drive). However, it is explicitly still subject to defenses in sections 1A and 1B of the Act. 1A covers spouses and partners. If you are the spouse or partner of a child between 16 and 18, then with their consent you can legally make indecent images of them (although this doesn’t apply if anyone but the two of you is in the image). You can also possess those images with their consent and give them a copy. Section 1B covers criminal proceedings, investigations, etc., and was added after R v. Bowden. Because copying a digital image counts as “making” an image, it would generally be illegal for people to work with digital copies of indecent images even if done for a good reason. To avoid that, Parliament made an exception for making an indecent image when necessary to prevent, detect, or investigate crimes, as well as for criminal proceedings anywhere in the world. Parliament also exempted the UK’s intelligence agencies (MI5, MI6, and GCHQ) when carrying out their duties. These are specific statutory exemptions, so they can’t really be generalized to “if you have a legitimate reason.”
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
The key issue here is the unauthorized collection of video thumbnails, not the use of cloud services. Under GDPR, every personal data processing activity has one or more controllers who are responsible for the activity, and every such activity needs a “legal basis”. With such cameras, the operator will typically be a controller, since they determine the purposes for which this camera is used. In this scenario, the operators – as part of their responsibility to conduct the data processing activity in a GDPR-compliant manner – had disabled any cloud features provided by the camera manufacturer. Despite this configuration, the camera manufacturer collected thumbnails and uploaded them to servers under their control. So, we likely have two distinct issues at hand: the camera manufacturer misled its customers about the privacy settings of the cameras. This is not necessarily a GDPR issue by itself. the manufacturer performed data processing activities in contravention of various aspects of the GDPR. Relevant aspects of the GDPR that might have been violated: the manufacturer did not have an Art 6 GDPR legal basis for this processing activity, such as a “legitimate interest” the manufacturer did not provide information per Art 13 GDPR to the people being monitored this way even if the cloud-based thumbnail processing were intended, this could be a violation against the Art 25 obligation to ensure “data protection by design and by default” depending on how the cloud storage services were configured, there might be violations against the Art 28 responsibility to contractually bind such vendors as data processors, or against the Chapter V rules on international data transfers Different actors might have different remedies against this violations: buyers of the camera might have remedies under consumer protection and product liability laws against the manufacturer data subjects of the illegal processing activity have remedies under the GDPR they can exercise their data subject rights against the data controllers, such as erasure of the thumbnails. However, this will be difficult to exercise in practice since the manufacturer will not have identifying information, and would then be free from having to fulfil certain data subject requests per Art 11 GDPR. they can lodge a complaint with a responsible supervisory authority, which would be the data protection agency in their EU/EEA member state (or the ICO in the UK). The EDPS is irrelevant here, since it is only the internal supervision authority for EU institutions. The competent supervisory authorities can levy fines. they can sue the data controllers, both for compliance (e.g. deleting unauthorized thumbnails) and for damages, if any were suffered. However, immaterial damages awarded for GDPR violations are typically fairly low, if they are recognized by the court at all. the right to judicial remedy (sue the controllers in court) and to lodge a complaint are independent. They largely pursue different remedies. Both can be used to seek compliance, but only supervisory authorities can impose fines, and only direct lawsuits by the data subjects can seek damages.