Data Protection not in Vogue?

The Irish Independent carries a story today about commuters being upset at having their images captured and published in a promotional video for a night club that was shot on the platform of Connolly Station (one of Dublin’s key commuter hub train stations) at the peak of rush hour. This story raises some interesting data protection issues that we will examine here.

The Data Protection Rules

There are 8 fundamental Data Protection rules that apply to all processing of personal data.

1. Data must be obtained fairly – data subjects need to know that data is being captured, or should have a reasonable expectation that the data would be captured and processed
2. Data must be obtained for a specified and lawful purpose – people need to be told what the data is going to be processed for, and the purpose must have a valid basis.
3. Data can’t be used in a manner that is incompatible with that original purpose (secondary purposes are allowed if they are not incompatible with the original purpose)
4. Data must be kept safe and secure (appropriate organisation and technical measures to protect data from unauthorised access/disclosure/alteration)
5. Data must be adequate, relevant, and not exessive for the purpose(s) for which it is being processed.
6. Data must be accurate and, where necessary, kept up-to-date
7. Data must be retained for no longer than is necessary for the purpose for which it was obtained
8. Individuals have a right of access to their data, among other rights.

Video recordings in which you are identifiable and can be singled out constitute personal data. The Article 29 Working Party examined this question back in 2007:

Considering the format or the medium on which that information is contained, the concept of personal data includes information available in whatever form, be it alphabetical, numerical, graphical, photographical or acoustic, for example. It includes information kept on paper, as well as information stored in a computer memory by means of binary code, or on a videotape, for instance

So, if you are captured on video, that video contains your personal data. It’s important to note that concept of “identifiable” doesn’t just mean “your face can be recognised” – in the context of data analytics it’s possible that analysis of how you walk might be sufficiently unique.

We’ll just examine the impact of the first two principles in this context: Fair Obtaining and for a Specified purpose. Note that personal recording of video may be exempt from the obligations under the Data Protection Acts, however the scope of that exemption needs to be interpreted very conservatively since a recent CJEU ruling that found that domestic CCTV that captured footage of a public area fell under the scope of the Data Protection rules.

Fair Obtaining, Purpose Specification, and the Signs

While Connolly train station is a public place and there is a limited expectation of privacy in public places (see Hickey v Sunday Newspapers for more on that), recording in public locations for commercial purposes is not exempt from the principles of the Data Protection Acts. The data (recordings) would still have to be obtained fairly, for a specified and lawful purpose, amongst other things. According to the article, there were two signs printed on 2 A4 sheets placed in on the entrance doors to the station which were spotted by someone stopping for a cigarette.

The concourse in Connolly Station is a very big space. Therefore there would be a question, in my view, over whether two small signs stuck to a door would be noticed in a busy rush hour commuter station. Also, sticking notices on the entrance doors to the station wouldn’t inform individuals coming on to the concourse from the trains, which is actually the direction the camera is pointing in the still image reproduced in the paper today. So commuters walking through the station from their train would have been unlikely to be aware that recording was taking place at that point in time. As the Independent article says:

Some people were seemingly unaware that filming for the video was taking place.

According to the Independent:

The notice said that the area was “being used for filming” and that by the virtue of people being in the area they acknowledging being informed that they may be photographed or recorded.

It is unclear from the article if the notice informed data subjects what the purpose of the filming was, who was doing the filming, or who they could contact to exercise their rights under the Data Protection Acts, but it did advise the public that

“Further, by your presence here, you grant your permission for your likeness and voice to be included therein without compensation, credit or consideration,”

and

“If you do not wish to be photographed, recorded or appear under these conditions, you should leave this area immediately,”

The recommended practice for Fair Processing notices for recording is that they should be placed in a prominent and visible location prior to people entering the field of vision of the camera, and that the attention of the public should be clearly drawn to the fact of the recording and the purposes of the recording.

Therefore, the publication of the recording on a Youtube channel as a means of promoting an event raises questions about whether the promoters met the standard for fair obtaining of data for a specified purpose.

No Way Out

Another issue is the statement that people should leave the area if they didn’t wish to be recorded or photographed. That’s actually not a bad statement in and of itself, but the practical question is: How would you leave the station concourse to exit the station without being recorded if the camera is pointing at the turnstiles and you have to walk past the camera to get to the ONLY exit from the station?

The “leave the area immediately” statement is an attempt to have a consent basis for publishing people’s images and voices in a video or still photograph. However, it is likely ineffective in this case because the consent to be recorded cannot be freely given in a case where you cannot avoid the camera (assuming you were even aware of it) as you try to leave the station. The only way that someone coming from the train, heading to the station exit, would be able to withold their consent in this circumstance would appear to be to invest in one of these.

No meaningful consent can be relied upon here as there was no alternative entrance way to the train station, and commuters going to the train who might be aware of the recording had no way of “opting out” if they so wished, other than going to a different train station.

But what about when the TV News records there?

TV news broadcasts are covered by a Journalistic exemption under the Data Protection Acts 1988 and 2003 and Directive 95/46/EC which permits journalists and news media to process personal data without having to meet most of the Data Protection principles, with the exception of keeping the information safe and secure.

Most TV news cameras have some form of station logo on them, and the journalist will usually have a microphone with a station logo on it, therefore anyone who sees them will be aware that filming is taking place. Furthermore, most TV news recordings are framed and shot in a way that doesn’t capture people’s faces or doesn’t capture them distinctly. Often faces will be obscured in post-production before broadcast.

What can concerned commuters do?

If you are concerned about the recording being posted to YouTube, this video shows you how you can have it removed.

You can also submit a Subject Access Request to the nightclub who commissioned the recording for a copy of your data under Section 4 of the Data Protection Acts.

What should/could the film crew have done?

There are a few things that the film crew could have done:

1. Asked Irish Rail to make some announcements to commuters that recording was taking place
2. Frame recordings in such away that people’s faces were not captured, or pixellate them in post-production before publishing the video.
3. Establish an “out of frame” corridor that commuters who want to be excluded from the recording could walk through, and guide people towards it
4. Overdub audio in post production to remove any voices of commuters
5. Use BIGGER SIGNS, and put them ON THE PLATFORM, and ON THE CONCOURSE so people would be able to see them

It is not a valid defence under the Data Protection Acts that you are “having a bit of fun” or “putting smiles on peoples faces”.

Conclusion

It’s a bit of a concern that Data Protection compliance concerns appear not to have featured in the news article, which (given the number of shots of the celebrity DJ involved that are included in the article, may well be advertorial masquerading as news – which raises a question about the reproduction of a still image in which people are clearly identifiable).

However, this story is a good example of how an appropriate amount of prior planning can prevent potential problems in Data Protection compliance. It also highlights the importance of the “surprised customer” test and the need to consider the outcomes and expectations of people with regard to the data that is processed about them.