German laws - new European "General Data Protection Regulation" (GDPR, DSGVO)

[Maximilian]

Disclaimer:
I really like the EU, although some things - like this - aren't as good as they should be.
I prefer having the EU instead of having a state like before 1951.
I will lock and/or delete this thread if it starts to become an EU bashing thread.
This is for your information and help for you photogs when you come to my country.
And I want to leave space for questions and on topic discussion, if needed.

*****************************************************************************************

Hello to all German photogs and people who take photos within Germany!
(and in similar way in the rest of the EU)

In May 25th the new German "Datenschutzgrundverordnung" (DSGVO, "Basic Data Protection Ordinance") became effective. (Oh how I love these compound words)
It is the German implementation of the latest data protection regulations in the EU and so it should be implemented by other EU countries as well, although their implementation might vary.

In its latest issue 07/2018 the Germany "fotomagazin" journal, together with a lawyer, took a closer juristic look at the DSGVO.

Their Conclusion/Interpretation:

• every picture of a person is a “personal data acquisition“ and therefore the DSGVO is relevant
• normally all relevant personal authorizations should be granted BEFORE a picture is taken
• all authorizations can be revoked unilaterally at any time
• "commercial use" seems to start with the upload to the internet, even if it is free of any charge or direct commercial use
• previously made and still active (!!!) laws/protections (KUG = copyright act of arts) of forms of art, e.g. street photography, documentation of current affairs/events and photojournalism are in contradiction to the new DSGVO
  (oh, I hate it, when lawmakers don't do their job right and open doors for floods of lawsuits)
• the DSGVO allows exceptions of these rules for "personal and familistic use"

My less formal summary:

• To all tourists:
  Don't be afraid, come to my country, enjoy your trip and take lots of photos, as long as you keep them with you and don't want to sell a calendar or photo book.
  And maybe ask somebody if you want to take a picture of her/him - as you surely did before
• To all commercial photogs:
  Please get informed with all relevant laws and keep an adequate form/contract/paper (according to the DSGVO) with you to set everything right if you want to use a picture of a person commercially

It will be funny how this is to be interpreted when it comes to wedding and other event photogs.
Maybe I am as the inviting person have to make a remark in my invitation on photos at that event.

 

[candyman]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

Hello Maximillian
Thank you for informing the community here.
This law apllies to all European countries as part of the European community.


Maybe you change the title to European law


The official European name for this regulation is: General Data Protection Regulation (GDPR)
Here is more information for the community

https://www.eugdpr.org/

Thanks

 

[Mikehit]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

Hello Maximillian
Thank you for informing the community here.
This law apllies to all European countries as part of the European community.


Maybe you change the title to European law


The official European name for this regulation is: General Data Protection Regulation (GDPR)
Here is more information for the community

https://www.eugdpr.org/

Thanks

Without knowing either law in detail I would hesitate to day that 'this law applies to all EU countries' because countries are free to add whatever bits and pieces of interpretation they want to (here in UK the government and civil service are well known for it). So Maximillian is correct when he refers to "the German implementation of the latest data protection regulations in the EU " and the way it is enacted in Germany will likely be different to how it is enacted in France or Portugal.
You then have the way the courts in each country interprets those laws, and the big issue is that there is precious little case law for data protection for people to say 'this is what it means' and anyone who tells you otherwise is, most times, whistling in the wind especially when they claim to know how the law impacts photography.

 

[LDS]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

Without knowing either law in detail I would hesitate to day that 'this law applies to all EU countries'

No. GDPR is effective from May 25th 2018 (after the two year period since it came into force), and it not only applies to EU countries, but to any entity which store and uses EU citizen personal data - even non EU ones.

The official site (in English, you can select other languages):

https://ec.europa.eu/info/law/law-topic/data-protection_en

It a complex matter, and it will take some time to understand all the dos and don'ts

 

[LDS]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

previously made and still active (!!!) laws/protections (KUG = copyright act of arts) of forms of art, e.g. street photography, documentation of current affairs/events and photojournalism are in contradiction to the new DSGVO

I don't know how the DSGVO is different from GDPR (or if they are the same), but "public interest" and "freedom of expression" are explicitly taken into account. See article 6 and article 85 of the GDPR, and local law needs to be harmonized.

There's a lot of FUD spread around about GDPR, and many lawyers looks to be unprepared despite the two year period allowed to understand it. Now most are running in circle crying "the sky is falling" - and for fear of been caught advise everybody that everything is at risk.

 

[Maximilian]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

Thanks for all your replies!

This law apllies to all European countries as part of the European community.

Thanks, candyman, you are right here. It is a European Regulation.
But as I am no lawyer and as the mentioned article is also taking some German laws into account, I will not change the Subject.
Except for one thing: as I didn't do a good research, I will replace my bad translation to the right English title and add, that it is a European regulation.

Without knowing either law in detail I would hesitate to day that 'this law applies to all EU countries'

GDPR is effective from May 25th 2018 (after the two year period since it came into force), and it not only applies to EU countries, but to any entity which store and uses EU citizen personal data - even non EU ones.

Thanks for adding this point, LDS. I forgot to mention that fact as well.

 

[Maximilian]

previously made and still active (!!!) laws/protections (KUG = copyright act of arts) of forms of art, e.g. street photography, documentation of current affairs/events and photojournalism are in contradiction to the new DSGVO

I don't know how the DSGVO is different from GDPR (or if they are the same)

As far as I understand EU law and this general regulation they must/should be the same.

but "public interest" and "freedom of expression" are explicitly taken into account. See article 6 and article 85 of the GDPR, and local law needs to be harmonized.

Right here as well and (German) lawmakers didn't do that up to May 25th, so the mess is there.
And they also didn't help to make the GDPR clearer in that.

There's a lot of FUD spread around about GDPR, and many lawyers looks to be unprepared despite the two year period allowed to understand it. Now most are running in circle crying "the sky is falling" - and for fear of been caught advise everybody that everything is at risk.

Yep! Really annoying. This was the reason why I was posting the interpretation of this journal.

 

[Mikehit]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

Hello Maximillian
Thank you for informing the community here.
This law apllies to all European countries as part of the European community.


Maybe you change the title to European law


The official European name for this regulation is: General Data Protection Regulation (GDPR)
Here is more information for the community

https://www.eugdpr.org/

Thanks

You right.

The interpretation of the Regulation is left to the European courts (the national courts and ultimately the European Court of Justice) and not to the Member States’ legislators. The national legislator can therefore neither copy the text of the Regulation when it is not necessary in the light of the criteria provided by the case law, nor interpret it or add additional conditions to the rules directly applicable under the Regulation. If they did, operators throughout the Union would again be faced with fragmentation and would not know which rules they have to obey.

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1517578296944&uri=CELEX%3A52018DC0043


So the fact the governments are not permitted to enact it in light of case law, nor can they add their own bits and pieces. But this also means that there is zero case law to go by and any lawyer's interpretation (as copied by Maximillian) is an educated guess.


But then GDPR (paragraph 153) says

Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation.

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX%3A32016R0679

So there is still heaps of movement as to what is covered by GDPR and what is not, and this seems to be the crux of the lawyers comments that Maximillian summarised.


The GDPR specifically says

The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.

So is photogrpahy covered or not? And does this affect how the photo magazine interpreted it?


See how messy this gets....?

 

[AlanF]

The UK regulator has announced that we in the UK will be applying GPDR with a light touch and the regulator is not out to get small people.

 

[LDS]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

So is photogrpahy covered or not? And does this affect how the photo magazine interpreted it?

See how messy this gets....?

Is permitted, as long as they are not used to process personal data. For example, all face recognition technology are not allowed (sorry Facebook and Adobe...).

Anyway, it will be messy for a while. GDPR is a game changer, tackles a new world were information can be gathered, stored, and processed too easily, without the "owner" permission. It's based on the principle that privacy is a basic right and personal data cannot be processed at will.

Of course it has to work with the other rights to be really effective. It will take some time to iron out all the doubts and issues.

 

[Mikehit]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

So is photogrpahy covered or not? And does this affect how the photo magazine interpreted it?

See how messy this gets....?

Is permitted, as long as they are not used to process personal data. For example, all face recognition technology are not allowed (sorry Facebook and Adobe...).

In your opinion.
The lawyers consulted by the German magazine said otherwise:

Their Conclusion/Interpretation:
every picture of a person is a “personal data acquisition“ and therefore the DSGVO is relevant
normally all relevant personal authorizations should be granted BEFORE a picture is taken
all authorizations can be revoked unilaterally at any time
"commercial use" seems to start with the upload to the internet, even if it is free of any charge or direct commercial use

previously made and still active (!!!) laws/protections (KUG = copyright act of arts) of forms of art, e.g. street photography, documentation of current affairs/events and photojournalism are in contradiction to the new DSGVO
(oh, I hate it, when lawmakers don't do their job right and open doors for floods of lawsuits)
the DSGVO allows exceptions of these rules for "personal and familistic use"

And how do the laws define 'personal use'? My picture of my wife/sister?
My picture of a stranger in the street?
What happens if the stranger decides to use the new laws to make me delete all those frames with him in them because of a breach of privacy?

So are you 100% sure you are right?

Now, I should say here your interpretation is the commonsense one, but lawyers do not work on 'common sense' and this regulation effectively scraps every bit of previous legislation on the books. It is less than 4 weeks old and no case law.

 

[Maximilian]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

...
And how do the laws define 'personal use'? My picture of my wife/sister?
My picture of a stranger in the street?
What happens if the stranger decides to use the new laws to make me delete all those frames with him in them because of a breach of privacy?

So are you 100% sure you are right?
...

As of the German personal rights even before DSGVO/GDPR everybody had the full right on pictures showing him/her more or less isolated or as dominant subject.
So if somebody takes a picture of me I already had the right to let him delete the picture.
It was different when a person was part of a larger group or event or else. Then there was no individual right on the picture for those shown on it.
Right now it is no longer clear to me if this has changed even though there is this exception because of "documentation of current affairs/events".

One exception my laywer told me: It is always allowed to take pictures of a crime sceene as a conservation of evidence. There is no "personal right" on a picture then - but not as onlooker/rubberneck!
BUT:
If you constantly film a scene in case a crime could happen (e.g. car dash cam) this again is forbidden.

 

[LDS]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

In your opinion.

No, in many of the GDPR articles.

The lawyers consulted by the German magazine said otherwise:

Due to my job (IT security), I've been pretty involved in this stuff for the past several months, including our legal team. I don't know who the lawyer is, and if she/he is referring to the GDPR or a German law.

See for example recital 18:

"This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities."


Note that while your "personal use" is exempt, the site you upload to may not.

Commercial use was regulated even before GDPR. Yet GDPR adds the "rights to be forgotten" - so you may have to remove images if someone asks so.

And 153:

"Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter. This should apply in particular to the processing of personal data in the audiovisual field and in news archives and press libraries. [...]"

Lawyers don't work on common sense, true, but they are also not always right, especially when they move in fields they may know little about.

You'll find many who to avoid any risk will tell you to block and stop everything. And if you're asking yourself today what GDPR means, you're two years too late

 

[Mikehit]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

Lawyers don't work on common sense, true, but they are also not always right, especially when they move in fields they may know little about.

You'll find many who to avoid any risk will tell you to block and stop everything. And if you're asking yourself today what GDPR means, you're two years too late

I agree totally. and this is where case law needs to develop.

 

[Maximilian]

Re: German laws - new German "Basic Data Protection Ordinance" (DSGVO)

...
I don't know who the lawyer is, and if she/he is referring to the GDPR or a German law.
...

His name is Dr. Endress Wankel, lawyer and university lecturer at the "Hamburg Media School"
http://www.hamburgmediaschool.com/koepfe/dozenten/alle/wanckel-endress/
(German only, sorry)

So I would suppose he knows what he's talking about.

And he is referring to both, GDPR and additionally German laws and as I posted before he is also showing up the conflicts between existing German and the ne European (and therefore also German) law.

 

[YuengLinger]

The law sounds extreme and paranoid. But, considering the history...

 

[LDS]

The law sounds extreme and paranoid. But, considering the history...

You should have missed the Facebook/Cambridge Analytica story, or the Equifax breach...

 

[ethanz]

I wonder if this law includes personal data protections against the government? Probably not

 

[YuengLinger]

But I doubt police and other government agencies are notifying all the people photographed in high resolution and put in databases. Of course they will never share those databases with other countries or corporations.

 

[Mikehit]

I wonder if this law includes personal data protections against the government? Probably not

Oh, it includes it. Bu the problem with a lot of data protection legislation comes down to 'you can do what you want as long as you can justify it'. But all data protection legislation is in its infancy and there is no clear definition of what is justifiable. And, of course, the government can justify whatever it wants....