SLOVENIA SA HAS DECIDED TO DELETE A PHOTO COLLECTION AS A RESULT OF EXERCISING THE RIGHT OF ERASURE ACCORDING TO GDPR ARTICLE 17

The controller, a media content production agency, was processing a collection of 88 photos taken over the last 7-15 years, representing the data subject participating in different social events. The photos were posted on a website and are also available for sale online.

One used the right of erasure (Right to be forgotten) defined in Article 17 of the GDPR.

He did not consent and objected to the processing of his personal data. There was no compelling legitimate reason for the processing.The controller did not accept his request with the explanation that the data processing is necessary for media activities, for the exercise of freedom of expression regarding the public's right to information, and (6) (1) (f) on the basis of legitimate interests pursuant to the GDPR.

Slovenia SA decided that the controller should delete all data from the website. The right to personal data protection needs to be balanced with freedom of expression and information.To justify an interference with the right to privacy, the controller must have demonstrated a strong public interest or justifiable reduction in the expectation of privacy. The content of the website did not contribute to discussions of social importance or relate to a topic of public interest. The individual was also not an absolute public figure.

Finally, the controller also failed to demonstrate its legitimate interests. For the reasons stated, the Slovenian SA decided to accept the complaint.

You can reach the press release here.