2

Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them.

Many of my friends have their personal assistance in their phones that is constantly hearing what happens in the vicinity of the phone. Sometimes, since they are my friends, these apps record my voice and process it.

I never consented to these companies to process and store my data, only my friends allowed it. However there is little doubt that these companies also have all these information about me, my facial expression, my voice signature, and many other personal information.

I have two questions: Is this permissible under EU private data law? Can I sue these companies for illegally storing so much information about me?

How can I prevent that such companies have so much information about me?

Improve this question
1
  • 3
    It's worth noting that the main enforcement duty of GDPR is expected to be through your national regulatory agency (Art 77) not through civil courts (Art 79); and in the case of civil suits GDPR expects (Art 80) something similar to USA "class action" suits, allowing you to mandate a larger organization to represent you in such a suit.
    – Peteris
    Commented Sep 24, 2019 at 3:48

1 Answer 1

Reset to default
3

Per GDPR Art 79, you can sue data controllers if you consider your rights to have been violated. Where you have suffered damages due to GDPR infringements, you also have a right to compensation per Art 82.

However, your rights may not have been violate as far as the GDPR is concerned. Under the GDPR any kind of personal data processing needs a clear purpose, and that purpose needs a legal basis. One possible legal basis is consent, but there also are others (such as legitimate interest). Just because you didn't consent doesn't mean that your rights have been violated.

Where processing is based on legitimate interest, you can object to that processing of your personal data – but your rights must be balanced against that legitimate interest (Art 21). If your friends post a photo and you only appear in the background, your friends' legitimate interest to post that photo likely outweighs your rights.

In practice, suing Facebook because of GDPR infringement is not a sensible way to achieve the outcomes that you likely want. First, this is expensive. Second, it is arguable whether Facebook or your friends should be the defendant. Third, removal of existing data won't prevent the processing of new data in the future. It would be more sensible to treat this as an interpersonal rather than a legal problem, and to talk with your friends so that they don't include you in their photos that they would like to share online.

I've focussed on photos because their situation is fairly clear. Voice snippets might not count as personal data when you are not identifiable in them. Personal assistant apps should not be listening continuously, but only start recording when a wake-word is recognized.

Improve this answer
3
  • 2
    How can personal assistant apps start recording when a wake-word is recognised unless they are listening continuously?
    – gota
    Commented Sep 23, 2019 at 19:41
  • 2
    @gota typically, phones have a low-power chip that continuously scans for sound patterns that match a wake-word. When a match is found, the phone is woken up and recording/speech recognition is started. Phones without such a chip usually only recognize wake-words while charging or while unlocked. Dedicated assistant devices like Alexa would have the power budget to listen continuously, but aren't supposed to. Sometimes errors happen and the assistant starts listening incorrectly, so there always are data protection concerns. But such concerns don't imply a GDPR violation.
    – amon
    Commented Sep 23, 2019 at 20:02
  • given these companies track record on abusing our personal data I would be extremely surprised to discover that although they have the power to continusouly process sound they choose not to do it
    – gota
    Commented Nov 13, 2019 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .