Now, the DPA has ordered the mobile disco to erase the photos and to fix a time limit for erasure of max 60 days for photos published on the Facebook page in future.
On 1 March 2021, the DPA made a decision concerning a mobile disco’s processing of personal data in connection with the publication of photos of children and young people on Facebook.
The DPA severely criticised the mobile disco for its processing of personal data on its Facebook page, as it had not taken place in accordance with the rules on valid consent. Furthermore, the DPA severely criticised the mobile disco for not having complied adequately with the obligations to provide data subjects with information in connection with the photos taken at the company’s events. The criticism is no surprise as it is in line with the rules and previous practice in this area.
Particularly noteworthy, however, is the DPA’s severe criticism of the mobile disco’s storage of photos. The photos, which had been taken at parties and similar events since 2013, had been stored and were still available on the company’s Facebook page which, according to the DPA, was far too long. The storage could not be justified by the fact that the individuals depicted tagged themselves in the photos several years later or that the data subjects should expect that the photos were available on the company’s Facebook page for a prolonged period.
Quite surprisingly, the DPA ordered the mobile disco to fix a time limit for erasure of max 60 days. The DPA’s decision was based on a specific assessment and the fact that the individuals depicted were mainly children and young people who enjoy special protection under the data protection rules.
However, although the decision was based on a specific assessment, it should encourage companies to review their own erasure policy for photos of identifiable individuals published on their social media – particularly photos of children and young people.