Complaint Case Notes

編號: 0071/2014/IP

標題: Photos showed citizens participating in an activity were used for promotion without their consent

立案原因: Complaint


    An individual complained to the Office for Personal Data Protection (GPDP) that Toyshop P took photos of his wife and underage daughter, without their consent given, and published them in Newspaper C for promotion.


    The investigation revealed that Toyshop P is an enterprise operated by Company Z.  During 2013, the latter organized a festival promotion in Toyshop B, during which staff was dressing as cartoon characters to take photos with the customers in the shop area.  The photos were taken as records of the said activity.  Next year, a journalist of Newspaper C asked Company Z for the concerning information, for a feature article, after he found out the same event would be organized again. Later, Company Z provided a number of photos taken during 2013 event to the journalist.  The photos contained the images of the Complainant’s wife and his underage daughter, as well as other customers who participated in the event.
  According to the information provided by Company Z and the photos published in Newspaper C, the Complainant’s wife and daughter were clearly shown in the photos.  As these are information that can identify the identities of the data subjects, they are regarded as personal data according to Article 4(1)(1) of the Personal Data Protection Act (PDPA or Law 8/2005).  Company Z processed these photos with electronic means, as a result its processing should be regarded as personal data processing by automatic means, which is subject to the PDPA according to its Article 3(1). 
  According to Article 4(1)(5) of the PDPA, Company Z is entity that operates Toyshop P, the former had the right to decide for the purposes and means of the processing of the data with regard to the photos taken during promotion.  In addition, the event photos were possessed by Company Z, and it had the freedom to decide whether to provide them to any third parties.  In other words, Company Z should be responsible for its provision of photos to Newspaper C and regarded as the data controller of the current case.    
  In view of the above, Company Z had to fulfill any of the criteria of legitimate processing as given in Article 6 of the PDPA. 
  According to the photos provided by Company Z, those participated in the festival promotion were photographed, but the cartoon characters were mainly those to be captured as intended.  In view of these, Company Z had the legitimate interests to photograph, for its internal records, the event took place inside the area of Toyshop P, which was open to the public.  However, Company Z’s processing of the photo data, which contained the images of the customers, should be limited to internal use.  As long as it provided the photos to Newspaper C, it first had to fulfill any of the legitimate processing criteria as laid down in Article 6 of the PDPA. 
  Company Z admitted that it had not obtained the consent from the Complainant with regard to the provision of photos to Newspaper C and no contractual relationship exited between them.  Considering that Company Z is not a public department, its provision of photos was not in compliance of legal obligation or for the performance of a task carried out in the public interests.  Based on the above, Company Z failed to achieve any of the criteria of legitimate processing, namely on the basis of the unambiguous consent of the data subjects or those laid down in paragraph (1) to (4) of Article 6 of PDPA. 
  In regard to whether Company Z fulfilled the legitimate criterion as laid down by paragraph (5) of Article 6 of the PDPA, the lawful interests of Company Z and that of the data subjects should be analyzed.  
  Although Company Z explained that the photos were provided at the request of Newspaper C for its feature article, which did not involve any advertising purposes, it also provided information of the event along with the photos and should have expected that promotional effects would be enhanced.
  The photos were taken inside the venue of Toyshop P, as operated by Company Z, did not justify that the data subjects would have expected the photos to be used as promotional information by the media, as they were originally taken for internal records.  This revealed that the publication of photos was out of the data subjects’ reasonable expectation.  Moreover, the use of the photos by Newspaper C was beyond Company Z’s control and could potentially harm the data subjects.  In other words, Company Z only focused on the potential promotional effects of the photos and ignored the reasonable expectation of the data subjects for their privacy.  
  Based on the above, Company Z’s interests in regard to its provision of photos to Newspaper C do not override the interests, rights, freedom and safeguard of the data subjects.  As a consequence, Company Z’s data processing did not fulfill the legitimate processing criterion as given in Article 6(5) of the PDPA. 
  To sum up, Company Z’s provision of photos, which contained the images of the Complainant’s wife and underage daughter, to Newspaper C did not fulfill the criteria as laid down in Article 6 of the PDPA.
  On the other hand, since Company Z deleted the photos at the request of the Complainant and asked Newspaper C to delete and stop using the said photos, no information proved violation of Article 12 of the PDPA, which governed the right to object.


    In this case, the photos that Company Z provided to Newspaper C not only contained the images of the Complainant’s wife and daughter, but also those who were at the event.  The feature article that published along with the photos did not contain any negative comments.  Moreover, Company Z had deleted the photos after being requested by the Complainant and also informed Newspaper C to delete and stop using the photos.  All these justified that Company Z attempted to provide remedies for the Complainant.  As this was the first violation of Article 6 by Company Z and its cooperativeness during the investigation, the GPDP decided to, according to Article 33(2) of the PDPA, impose a penalty of MOP10000 to Company Z.

Please refer to Article 3, 4, 6, 12 and 33 of the Personal Data Protection Act.