Hacker News Reader

Comment by wjnc | Hacker News Reader

The verdict [1, Dutch] is somewhat less interesting than it seems since it was a summary proceedings with both lawyers (and the judge) not really versed in GDPR and due to covid quite limited interaction.

The grandmother could have argued legitimate interest (she is a grandmother and took care of one of the children) and have demonstrated limited visibility (now there was no mention of posting publically or not, so the judge went with publically) and the case would have started to get interesting.

Now it was just a slam dunk. No permission, no argument for use case under GDPR, done.

[1] https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:...

View on HN

What specific Legitimate Interest necessitates processing of personal data in this particular case? Taking care of the children? If there's a way that she can reasonably accomplish that without posting to Facebook, then it's not covered by Legitimate Interest.

She doesn't have to argue that the utility exists for some practical purpose like babysitting - she would only need to argue that the pictures were taken by her, and that she uses them personally to look at the images of her grandchildren for her own personal happiness (which has utility).

The Legitimate Interests basis for processing personal data is a qualified one, though:

>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

So where there is any doubt one must test the idea that the data subject's rights outweigh one's legitimate interests.

I admit the purpose does not have to be practical. But the principle of Data Minimization still applies. If she can personally enjoy the pictures without posting them to Facebook, then that purpose does not cover posting them to Facebook. It probably would cover cloud back-ups that don't share with other people.

My overall point is that simply claiming "Legitimate Interest!" is not a free pass to do whatever you want.

Which demonstrates how easily such laws are abused even when they don't technically apply. How much money and time are grandma willing to invest for the sake a few pics? How much less likely is she to post more? Whatever the benefits and details of the GDPR its chilling repercussions are non trivial.

The "chilling repercussions" of making illicit publishing of personal data illegal?

That is the whole point of privacy laws! It's like saying that laws against theft cost you so much money since they make you pay in the supermarket.

There is a long tradition of grandmothers showing pictures of their grandchildren. Is that now banned or does it require prior notice in writing by each child? Does she have to wait until the child is an adult and can provide legal authorization?

To an unrestricted public?

I have never heard of the long tradition of grandmothers publishing their grandchildrens' photos in a newspaper or handing out photo leaflets.

They usually show those pictures to a few friends. In person. In their photo album at home.

(The GDPR doesn't cover that, obviously, because it is meant to address the rather new phenomenon of world-wide audiences)

I’d argue there is a long tradition of grandmothers showing pictures of their grandchildren to a limited audience in the form of physical photo albums.

The internet is relatively young; there is no “tradition” of grandmothers posting pictures of their grandchildren on Facebook publicly (not just to “friends”).

Online privacy is an entirely different beast. The world is still iterating on how to deal with it.

Showing pictures in a personal scrapbook != sharing them with a third party (Facebook) and (depending on the privacy settings), potentially the entire world. Further, the digital nature of the photo means that any person on the internet viewing the photo that grandma is "showing" can download it for personal use, whatever use that might be (including illicit).

An analogy in scrapbook terms would be if grandma walked into a public square and put photos of her grandchildren onto a billboard, and every person who walked up to see them can peel off a copy, with no limit to the number of copies that can be peeled off this way.

It requires the grandmothers remove the pictures when requested by the child's guardian.

They would not however post it in newspaper and they would not stick it to common board. Showing it in public and showing it to few friends is different.

Also, few years ago, grandma needed to be given picture by parents. She would not snap picture parents did not wanted, because cameras were not something you normally have with you all the time.

I was a nudist at home with my parents and sometimes other family members. I didn't like naked pictures of me being shared with strangers.

I was comfortable being naked around people I knew and trusted.

My grandparents didn't always give a shit about my comfort levels and shared pictures of me in various states of dress with others.

I think I should have a clear and cut right to decide if I'm comfortable or not. Especially when I voiced those concerns as a kid.

Reply on news.ycombinator.com