3 ms·

> It's every photo in Facebook's entire database that ever included a recognisable image of them, tagged or not. That is from my understanding wrong. In fact F

> It's every photo in Facebook's entire database that ever included a recognisable image of them, tagged or not. That is from my understanding wrong. In fact Facebook would not be permitted to establish the link. Just you appearing in the picture but it not being your picture does not qualify for personal data.

Silhouette 9y ago
Any information that relates to an identified or identifiable natural person is personal data for these purposes. This remains essentially the same, except for a slightly broader specification of what constitutes identifiability, under the GDPR as under the current EU framework. In particular, under the GDPR, identifiers explicitly include factors specific to a person's physical or genetic identity. In short, if you're in a photo and it's recognisably you, it's personal data.
- the_mitsuhiko 9y ago
  I'm sorry but you are wrong about that. The data is fundamentally scoped.
  - Silhouette 9y ago
    I don't understand what you mean by "fundamentally scoped" in this context, so perhaps we're talking at cross-purposes here. However, the wording I used before was actually taken directly from the GDPR itself[1]. Moreover, the interpretation that an otherwise unidentified image of someone may become personal data even if collected incidentally such as in a photo taken for other purposes or on CCTV is supported by among others the ICO (the UK's data protection regulator). There are a few specific examples in some of their published guidance [2,3,4]. Unless your argument is that Facebook isn't processing those photos in any way that would cause that interpretation to apply? In that case, I can maybe see how your argument works, but given what we know of Facebook processing uploaded photos just from the features they offer publicly, it's hard to imagine how their processing could possibly not be sufficient for all photos they hold to be treated as personal data. [1] http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN..., Article 4, clause (1), where "personal data" is defined [2] https://ico.org.uk/media/for-organisations/documents/1554/determining-what-is-personal-data.pdf https://ico.org.uk/media/for-organisations/documents/1554/de... [3] https://ico.org.uk/for-the-public/schools/photos https://ico.org.uk/for-the-public/schools/photos [4] https://ico.org.uk/for-the-public/cctv/ https://ico.org.uk/for-the-public/cctv/
    - the_mitsuhiko 9y ago
      > I don't understand what you mean by "fundamentally scoped" in this context, so perhaps we're talking at cross-purposes here. If you have a social network and you have a user A and a user B. Each of them uploads a picture in private showing both of the users on the image. If user A deletes his or her account the picture in user B's account is not to be deleted even though it contains a picture of user A.
      - Silhouette 9y ago
        But if user A withdraws their consent for the social network to process personal data about them, user B's photo is still personal data about user A if the social network knows or could know that user A is in it. As I mentioned before, modern technologies raise complex issues about third parties that we have barely begun to explore. SOP at social networks is very much to get people to provide information about not only themselves but also other people they know, and that's a minefield if those other people aren't happy about it. Obviously you can't just say social networks can do what they want if someone else provided the personal data, because that undermines the entire principle of data protection and privacy. But equally, if you require explicit consent from everyone for everything, you create a huge burden that might make the whole idea unworkable or at least remove a lot of the value these services offer to their users when maybe a lot of people wouldn't have a problem with, say, a friend tagging them in a photo anyway. As things stand, taking the GDPR at face value, I don't see how it would be legal for a social network to retain any photo in which someone is identifiable if that person doesn't consent, unless that social network also took rather dramatic steps like avoiding any sort of automated processing and analysis of photos that might identify people in them, as well as removing features like letting a user tag someone who isn't a member of the social network.
        the_mitsuhiko 9y ago
        > But if user A withdraws their consent for the social network to process personal data about them, user B's photo is still personal data about user A if the social network knows or could know that user A is in it. Except that is not included in this. You are in fact not even supposed to retain data to identify a user after their account has been used to match them on other data. I don't know the law by heart right now but I had discussions even a year ago with people consulting on this about this very topic what to do for such cases. This law was not drafted in a vacuum where nobody looked at real world situations.

Silhouette 9y ago

Any information that relates to an identified or identifiable natural person is personal data for these purposes. This remains essentially the same, except for a slightly broader specification of what constitutes identifiability, under the GDPR as under the current EU framework. In particular, under the GDPR, identifiers explicitly include factors specific to a person's physical or genetic identity. In short, if you're in a photo and it's recognisably you, it's personal data.

the_mitsuhiko 9y ago
I'm sorry but you are wrong about that. The data is fundamentally scoped.
- Silhouette 9y ago
  I don't understand what you mean by "fundamentally scoped" in this context, so perhaps we're talking at cross-purposes here. However, the wording I used before was actually taken directly from the GDPR itself[1]. Moreover, the interpretation that an otherwise unidentified image of someone may become personal data even if collected incidentally such as in a photo taken for other purposes or on CCTV is supported by among others the ICO (the UK's data protection regulator). There are a few specific examples in some of their published guidance [2,3,4]. Unless your argument is that Facebook isn't processing those photos in any way that would cause that interpretation to apply? In that case, I can maybe see how your argument works, but given what we know of Facebook processing uploaded photos just from the features they offer publicly, it's hard to imagine how their processing could possibly not be sufficient for all photos they hold to be treated as personal data. [1] http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN..., Article 4, clause (1), where "personal data" is defined [2] https://ico.org.uk/media/for-organisations/documents/1554/determining-what-is-personal-data.pdf https://ico.org.uk/media/for-organisations/documents/1554/de... [3] https://ico.org.uk/for-the-public/schools/photos https://ico.org.uk/for-the-public/schools/photos [4] https://ico.org.uk/for-the-public/cctv/ https://ico.org.uk/for-the-public/cctv/
  - the_mitsuhiko 9y ago
    > I don't understand what you mean by "fundamentally scoped" in this context, so perhaps we're talking at cross-purposes here. If you have a social network and you have a user A and a user B. Each of them uploads a picture in private showing both of the users on the image. If user A deletes his or her account the picture in user B's account is not to be deleted even though it contains a picture of user A.
    - Silhouette 9y ago
      But if user A withdraws their consent for the social network to process personal data about them, user B's photo is still personal data about user A if the social network knows or could know that user A is in it. As I mentioned before, modern technologies raise complex issues about third parties that we have barely begun to explore. SOP at social networks is very much to get people to provide information about not only themselves but also other people they know, and that's a minefield if those other people aren't happy about it. Obviously you can't just say social networks can do what they want if someone else provided the personal data, because that undermines the entire principle of data protection and privacy. But equally, if you require explicit consent from everyone for everything, you create a huge burden that might make the whole idea unworkable or at least remove a lot of the value these services offer to their users when maybe a lot of people wouldn't have a problem with, say, a friend tagging them in a photo anyway. As things stand, taking the GDPR at face value, I don't see how it would be legal for a social network to retain any photo in which someone is identifiable if that person doesn't consent, unless that social network also took rather dramatic steps like avoiding any sort of automated processing and analysis of photos that might identify people in them, as well as removing features like letting a user tag someone who isn't a member of the social network.
      - the_mitsuhiko 9y ago
        > But if user A withdraws their consent for the social network to process personal data about them, user B's photo is still personal data about user A if the social network knows or could know that user A is in it. Except that is not included in this. You are in fact not even supposed to retain data to identify a user after their account has been used to match them on other data. I don't know the law by heart right now but I had discussions even a year ago with people consulting on this about this very topic what to do for such cases. This law was not drafted in a vacuum where nobody looked at real world situations.