Privacy and GDPR on Facebook

Question

I have a doubt regarding the privacy on Facebook and the law application. Also lawyers That I have spoken with, seem not very sure about the matter. In particular I would like to know if it is my right to ask the removal of photos of me that other people have shared in Messenger and in Private groups. If it is my right, to whom I should address the problem? To people that have shared my photos (again in private chats and groups) or to Facebook? I have already kindly asked to remove the photos to people but I have not received reply. How can I have the proof that the photos have been deleted?

In my opinion, since the photos were shared using Facebook they cannot considered private as it is an online tool and social media. What do you think?

Thank you in advance for your help!

Answer 1

You are trying to invoke your Art 17 GDPR right to erasure. However, this right has many limitations. As a rule of thumb, your GDPR rights might not apply if their exercise would negatively impact other people.

In this scenario, you're seeking to delete images from other people's private chats. Requiring Facebook to search their chat messages according to your instructions would likely be a disproportionate invasion into those people's privacy, unless those images are inherently illegal. Even if you were the copyright holder for these images, it would likely be disproportionate to retroactively search the chats and potentially delete images. But you can't be the copyright holder since you didn't create those photos.

All of this means:

• Facebook will likely refuse to act on your requests.
• Those other people will likely refuse your requests.
• A court is unlikely to order Facebook or those other people to perform a search and delete offending images.

You are claiming that since the images were shared with Facebook that there wouldn't be any expectation of privacy. This is a valid argument in the US (see the third party doctrine). However, this argument doesn't fly in Europe in the context of the GDPR. Under the GDPR, any processing of personal data requires a legal basis, such as a specific law, the user's consent, or a legitimate interest. Facebook is bound by its privacy policy to keep private chats private. It has no legal basis to search those chats for the purpose of fulfilling your requests, unless you can get a valid court order that compels Facebook.

Most likely, you won't be able to prevent private use of these images, for example your ex shares them in private messages. However, you may have personality rights that prevent wider circulation and publication of these images. That is difficult to enforce in the context of the internet, but it's more enforceable than what you're currently trying to do. If you're in a photo and you don't like it, you can report the photo to Facebook.

Answer 2

This question cannot be answered authoritatively until these issues are taken up in court. However I believe you would have a good case. Photographs as you describe could be considered special category data. The aspects that may be relevant here are (from UK law):

• personal data revealing racial or ethnic origin;
• biometric data (where used for identification purposes);
• data concerning a person’s sex life; and
• data concerning a person’s sexual orientation.

This imposes extra requirements on the data processor. The legal basis for processing in this case are limited to:

• Explicit consent
• Employment, social security and social protection (if authorised by law)
• Vital interests
• Not-for-profit bodies
• Made public by the data subject
• Legal claims or judicial acts
• Reasons of substantial public interest (with a basis in law)
• Health or social care (with a basis in law)
• Public health (with a basis in law)
• Archiving, research and statistics (with a basis in law)

It would appear that facebook would not be able to meet any of these requirements. It they refuse your request it is possible you may be able to get the relevant authorities in your area (the ICO in the UK). In the likely event they are unwilling to take action, you would need to initiate proceedings yourself, which will be expensive.