Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?

From recreation of famous paintings using household materials to baking sourdough breads with home-made starters: the lockdown has prompted many of us to explore new hobbies. So, too, this Kat. The curiosity spread to the legal domain, and I was grateful to do some reading on issues outside my regular expertise. Some of it resulted on this post on an issue I find captivating: the interface between privacy and social networks.

I was prompted to write it by a recent decision of the Gelderland district court in the Netherlands [here], which ordered a person to remove from her Facebook and Pinterest accounts a picture of her underage grandchild, at the request of the child's mother (the defendant's daughter). This raises the question what rights, if any, a person in such a position should be able to claim to post such pictures.

The case

The decision was rendered in preliminary relief proceedings and is therefore succinct; it is also anonymised so I will refer to the parties using letters.

A is the mother of B, who is the mother of C and two other children. Due to a fight, A and B have not spoken to each other for years. For a period of seven years, C lived with A and her husband. Thereafter, C moved in with his father, the ex-partner of B. B filed suit against A, requesting that she remove from her social media profiles all pictures of her children, since neither she nor her ex-partner consented to publishing them.

A removed all such pictures, but asked the court to let her keep online one picture of C because she has a special relationship with him after taking care of him for several years.

The court granted B's request and ordered A to take offline all pictures from all of her social media accounts. It assessed the claims under Regulation 2016/679 (the General Data Protection Regulation or GDPR). No copyright issues were at stake because neither party claimed authorship of the pictures.

Article 2(2)(c) GDPR exempts from its material scope processing of personal data "by a natural person in the course of a purely personal or household activity". The court acknowledged that "it cannot be excluded" that placing a picture on a Facebook or Pinterest page might be exempted from GDPR scrutiny on the basis of this provision, but held that it had not been established that A's pages were inaccessible to the general public. The court added that it remained unclear whether the pictures could be found through Google, and that in the case of Facebook it cannot be excluded that the placed pictures can be spread and downloaded by third parties.

This largely decided the case. The Dutch act implementing the GDPR [here] states, in Article 5, that in the case of minors, their legal guardian must consent to the data processing. Since C is a minor and his parents expressly disagreed with keeping the picture on A's Facebook page, it had to be taken offline.

Author's cats looking away from the camera in protest of author's repeated violations of their privacy. It is a good thing kittens don't have standing to sue.

Comment

The case is a great illustration of how difficult it often is to comment on decisions merely on the basis of their text: several facts that remain unknown to us may have severely affected the outcome. In particular, the nature of the picture could influence the outcome of the case. The decision is silent on this point. Assuming, however, it is an ordinary picture, the following observations can be made.

Is social networking a personal or household activity?

First and foremost, there is the matter of the personal-or-household-activity exception. The exception appeared already in the GDPR's predecessor, Directive 95/46/EC [here] and the most authoritative interpretation remains the Court of Justice EU (CJEU)'s decision in C-101/01 Lindqvist. Referring to examples of "correspondence and the holding of records of addresses" cited in the Directive's preamble, the CJEU there ruled that the "exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people."

It has been argued that in current times, where for many social networks are the primary outlet for personal contacts and expression, this is an unduly narrow interpretation of the exception. For instance, the Article 29 Working Party (WP29) issued a guidance paper in which it discussed the ascent of social networking and the extent to which data processing on such sites should be considered strictly 'personal' [here]. According to WP29, "making information available to the world at large should be an important consideration when assessing whether or not processing is being done for personal purposes. However, this should not in itself be considered determinative" [page 9].

Recital (18) of the GDPR reflects this recommendation, stating as it does that "social networking and online activity undertaken within the context of [household] activities" should fall within the exemption of Article 2(2)(c). But then one wonders why the court adopted such a restrictive interpretation of this exemption.

This Kat also wonders whether in a case as was before the Dutch court it might have been preferable to order the defendant to close her Facebook and Pinterest pages to the public. If the concern was that the pictures could be viewed by an indefinite number of people, this would solve that problem; and as will be discussed below, the defendant likely had countervailing rights that entitle her to place the picture online.

An order to close off the pages from the public, rather than an order to remove the pictures altogether, might therefore have been mandated by the general principle of proportionality, as it appears in the case-law of the CJEU and the European Court of Human Rights (ECtHR). For instance, in C-484/14 McFadden, the CJEU sought a remedy that would least infringe the defendant's rights, and in 26839/05 Kennedy v. UK the ECtHR accepted a surveillance regime only subject to provision of sufficient safeguards against abuse. To be sure, McFadden was not a privacy case and Kennedy related to mass surveillance, but in both cases the outcome was mandated by a desire to reach a fair balance between the fundamental rights involved. A similar approach might be necessary in a case like this one.

Which rights should be considered?

If the household exemption applies, the case falls outside the scope of the GDPR and should be assessed under a general balance of rights inquiry. But which rights, and whose? On the part of the minor, it seems clear: his right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU's Charter of Fundamental Rights.

But the boy's grandmother's fundamental rights might well be at stake, too. There is, of course, the right to freedom of expression – Article 10 of both the ECHR and the Charter – but that somehow doesn't fully capture the situation at issue. Posting on one's social media page a picture of your grandson, who lived with you for seven years, is not 'just' an expression like any other. In the age of social media, it expresses a personal connection between two people.

In a 2017 book chapter, Professor Lorna Woods has argued that "when many spend a lot of their time on social media, internet use is about developing personality and identity" [page 118]. She therefore submits that social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter).

What is more, the ECtHR has repeatedly held that the relationship between a grandparent and a grandchild is protected under this same provision [see, e.g., 63190/16 Beccarini and Ridolfi v. Italy, at 50]. The court should have thus considered A's protected interests under Article 8 ECHR in posting a picture of her grandson before ordering her to take it offline. Surely that would make the matter more complex, but – as Zuzanna Warso wrote in 2013 – simply dismissing the grandmother's position would result in an imbalance in the protection of fundamental rights, given the increasing role the Internet plays in personal and social lives.

A final question: what about the rights of B, the mother? Assuming she was not in the picture, it is questionable whether she could invoke rights of her own in support of her claim to take offline the picture of her son. If, from a rights perspective, her position is limited to that of legal guardian, the inquiry becomes even more complex. After all, it is not clear that her animosity towards her mother can impose limits on the family life her mother enjoys with her grandson. But here, too, we simply don't know enough about the case, so further speculation is probably best reserved for the next case.