Is photo personal data
Numerous disputes have not been able to unequivocally establish whether the photo is personal data and whether it refers to biometric information. The positions of regulators and courts change frequently, and practices differ from region to region. There is no single logic for making a decision - in each specific case, it is based on the exceptions established by law.
When photography is known to be a PD
Often there is a situation when photos on passes to work or to a closed territory of multi-storey residential complexes are recognized as PD and for their use without obtaining a specially issued consent of the organization are brought to justice. Roskomnadzor, in response to numerous requests from operators of personal data, explained that in order to apply the law "On Personal Data", biometric personal data includes information that characterizes the physiological and biological characteristics of a person, and on their basis, directly or using technical solutions, it is possible to establish his identity ...
The position is based on the fact that:
- not every image is personal data;
- to make a decision on attribution to this category, the operator must use the photo to establish his identity. The image of a person when using it should be the basis for his identification - when he passes to work, to school.
Consent to the use of personal data must be drawn up if the above interpretation of the law makes it possible to classify a particular photo as biometric personal data. The written consent form is not established by law, but it is typical for most cases of PD processing. There are also exceptions provided for by federal laws.
So, consent to the processing of personal data is not required if:
- the situation is related to the country's implementation of an international treaty;
- the image is being processed for the purpose of administering justice;
- processing of biometric data occurs in connection with the implementation of defense goals, the fight against terrorism, and operational search activities.
In addition to photos, the law includes fingerprints, the iris of the eyes, DNA tests, height, weight, metric information, for example, facial measurement data, as well as other physiological or biological characteristics of a person, displayed, including in video, as biometric personal data. Biometric personal data will always include a picture for a foreign passport made using technical means of obtaining a biometric image. This is reminiscent of the Government Decree No. 125, dedicated to the issues of issuing foreign passports.
Often questions are raised by the requirement of an organization to provide a photo, especially against the background of a real estate object or with a passport in hand for identification, without prior approval. Banks, day laborers, and e-wallet operators do this most often. A citizen in each case of using such photos himself assesses the degree of risk. If it seems high to him, he should seek protection - send a complaint to Roskomnadzor with a request to prosecute for the unlawful requirement of PD without obtaining consent. The organization is obliged to explain the peculiarities of image processing and use, the procedure and terms of its storage.
When the photo does not apply to PD
The main condition for classifying a photograph as biometric data is its use by the operator for identification purposes. The regulator names several specific situations in which the snapshot will in no case be classified as personal data, the circulation of which is limited and for the use of which it is necessary to obtain consent:
- the image is necessary for the implementation of political, state, public interests. It is also not illegal to use personal data to post a photo of the politician in the newspaper. In this case, the publication of a photo of someone else's child will be considered a violation;
- a photo or video image was taken in a public, public place open to the general public: in a theater, at a rally, at a sports event. It can be freely posted in the media without the consent of the citizen. An exception is the situation when it is obtained for the purpose of commercial use, in which case the consent of a private person is required;
- the photograph was obtained when a citizen posed for a monetary reward, knowing in advance that the image would be used in advertising or in any other way.
These situations exclude any prosecution for the misuse of a person's photographic image.
14.12.2020
