Personal data published without consent: what to do and what to demand

If another person or an organisation has publicly posted your name, photo or other data, for example in an open social-media group, you have several routes. You can demand that the data be erased, report the post to the platform, lodge a complaint with the State Data Protection Inspectorate (VDAI) and go to court for damages.

Two things matter from the start. First, not every publication without consent is unlawful: consent is only one of six legal bases. Second, if the published information is false and degrading, this is no longer only a data protection question. Then the main protection is under the Civil Code, and a court decides it.

Does the GDPR apply at all

The Regulation does not apply when data are processed by a natural person in the course of a purely personal or household activity (Article 2(2)(c) GDPR). Recital 18 GDPR says such activities could include social networking undertaken within the context of such activities. So a message to a friend or a photo in a closed family chat usually stays outside the Regulation.

Public posting is a different case. In Case C-101/01 (Lindqvist) the Court of Justice interpreted the same exception in the earlier Directive 95/46. It held that the exception covers only activities within private or family life, which is clearly not the case when data are published on the internet and made accessible to an indefinite number of people (paragraph 47 of the judgment). The Court repeated this in Case C-345/17 (Buivids) for a video published without restricting access (paragraph 43 of the judgment). A post in an open group that anyone can see is exactly that case. So the GDPR also applies to a private individual who posted your data in this way. We write more about the limits of the Regulation in the article who does the GDPR apply to.

Consent is not the only legal basis

Article 6(1) GDPR lists six bases on which processing is lawful. Consent is only the first of them. Others include, for example, a legal obligation and legitimate interest. So the question is whether the person who posted had at least one basis and, if it is legitimate interest, whether it outweighs your interests (Article 6(1)(f) GDPR). When consent is valid, and when it is not, is covered in Consent under the GDPR: when you need it and when it is invalid.

A separate rule applies to journalism and expression. When data are processed for journalistic purposes or for academic, artistic or literary expression, a large part of the GDPR, including the data subject’s rights, does not apply (Article 4 ADTAĮ). Such processing is supervised not by VDAI but by the Inspector of Journalist Ethics (Article 7(2) ADTAĮ). In addition, the right to erasure does not apply where processing is necessary for exercising the right of freedom of expression and information (Article 17(3)(a) GDPR). What matters is the purpose, not who published. In Case C-345/17 (Buivids) the Court of Justice held that these exemptions apply not only to media undertakings but to every person engaged in journalism (paragraph 52 of the judgment). The fact that a person is not a professional journalist does not in itself exclude them (paragraph 55). But not all information published on the internet is journalism (paragraph 58): it must be checked whether the sole purpose of the publication was to disclose information, opinions or ideas to the public (paragraph 59). The Court interpreted Article 9 of the earlier Directive 95/46.

What you can demand under the GDPR

Erasure. You can demand erasure of data that have been processed unlawfully (Article 17(1)(d) GDPR). Write to the person who posted, so that you keep proof. When an erasure request must be met and when you may refuse is covered in Erasure requests: when you must erase and when you may refuse.

Rectification. If the published data about you are inaccurate, you can demand that they be rectified (Article 16 GDPR).

Objection. Where the processing is based on legitimate interest, you can object on grounds relating to your particular situation (Article 21(1) GDPR). The person who posted must then show compelling legitimate grounds that override your interests, or that the data are needed for the establishment, exercise or defence of legal claims. Otherwise they must stop processing the data.

A complaint. If there is no reply within one month, or the reply does not satisfy you, you can turn to VDAI (Article 77(1) GDPR). Do not file a complaint about your rights earlier: VDAI refuses to examine such a complaint filed before the one-month period has passed (Article 27(2)(3) ADTAĮ). It also refuses a complaint on the same matter that has been or is being examined by a court (Article 27(1)(4) ADTAĮ), and a complaint filed more than 2 years after the infringement (Article 27(1)(8) ADTAĮ). How long this takes and what to expect is described in the article complaint to VDAI: how long it takes and what happens next.

Compensation. Any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to compensation (Article 82(1) GDPR). A court decides this. You can go to court without first complaining to the authority (Article 79(1) GDPR). Since VDAI does not examine what is already before a court, it is worth choosing the route in advance.

The Civil Code: image, private life, honour

These rules apply whether or not the GDPR applies. So they also work when the posting falls within the household exception.

Photos. A person’s photo may be displayed or printed only with their consent (Article 2.22(1) CK). Consent is not needed where this relates to the person’s public activity or official position, is required by law-enforcement authorities, or the photo is taken in a public place. But even such a photo may not be displayed if that would degrade the person’s honour, dignity or professional reputation (Article 2.22(2) CK). The person may ask a court to stop such acts and to award compensation for pecuniary and non-pecuniary damage (Article 2.22(3) CK).

Private life. Information about a person’s private life may be published only with their consent (Article 2.23(1) CK). An exception is possible where, given the person’s office or position in society, disclosure meets a legitimate and justified public interest (Article 2.23(3) CK). A claim for damages is possible even where the published data are true (Article 2.23(4) CK).

Honour and dignity. If the published data are untrue and degrade your honour and dignity, you can ask a court to order a refutation and compensation (Article 2.24(1) CK). The law presumes that the published data are untrue until the person who spread them proves otherwise. If the data concern a public figure and their public activity, the person who published them is not liable if they prove they acted in good faith (Article 2.24(6) CK).

The platform and the evidence

Social networks have their own tools for reporting inappropriate content. A report to the platform can be the fastest way to get a post removed. But save the evidence first, because once the post is removed it is gone.

What to save:

• screenshots showing the whole post, the author, the date and the comments;
• the exact link (URL) to the post and the group;
• whether the group is public or closed, and how many members it has;
• your erasure request and the reply you received.

This answers the key legal question: were the data accessible to an indefinite audience. Whether the GDPR applies depends on it.

When an organisation receives the request

If a company or public body posted the data, for example on its website or account, it is the controller. When it receives a request for erasure or an objection, it must reply no later than one month (Article 12(3) GDPR). If it does not act on the request, it must, within the same month, give its reasons and state the possibility of complaining to a supervisory authority and seeking a judicial remedy (Article 12(4) GDPR). How and when to answer a subject access request is covered in Subject access requests: the deadline and the answer.

If the organisation made the data public and must erase them, it must, taking account of available technology and the cost of implementation, take reasonable steps to inform other controllers processing the data (Article 17(2) GDPR).

What can go wrong

For the person whose data were posted, three things can go wrong:

• The evidence disappears. The post is removed before screenshots are taken. Later there is nothing to show the authority or the court.
• The wrong route is chosen. Inaccurate data can be rectified under Article 16 GDPR. But protecting honour and dignity, including a refutation, is a court route under Article 2.24(1) CK.
• The wrong authority is approached. If the data were published for journalistic or expressive purposes, whether by the media or by a private person, the Inspector of Journalist Ethics is competent (Article 7(2) ADTAĮ).

For an organisation, an unanswered or late request is a separate infringement, whether or not the posting itself was lawful. For infringements of data subjects’ rights, the Regulation provides for administrative fines of up to 20 million euros or, for an undertaking, up to 4 % of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5)(b) GDPR). ADTAĮ sets lower caps for public authorities and bodies (Article 33(2) ADTAĮ), unless they carry out commercial activity (Article 33(3) ADTAĮ).

When to call a lawyer

You usually do not need a lawyer to complain to VDAI. The authority can itself demand explanations from the person who posted. A lawyer helps when:

• you want to claim compensation in court;
• the published information is false and degrading, so a refutation is needed;
• the data were published by the media, or the person who posted relies on freedom of expression;
• you are an organisation that received a request and are unsure whether your legitimate interest outweighs the person’s interests.