Facebook profile photo may be used to enforce a ''ban on presence''

The Litigation Chamber of the Data Protection Authority (DPA) ruled in decision No 35/2020 that an unspecified Belgian disciplinary and judicial authority (“Sports Court”) was entitled to forward a profile photo of Facebook to sports commissioners in order to have a so-called “ban on presence”, meaning that one is not allowed to attend a sporting event, enforced. A brief explanation.

1. What had happened?

The complainant had lodged a complaint against the Sports Court (first defendant) and the clerk of the Sports Court (second defendant). According to the complainant, the clerk had infringed the GDPR by sendinghis Facebook profile photo by e-mail to the sports commissioners of a forthcoming event and to the organising institution. According to the complainant, this profile photo would not be freely accessible as he applied the strictest privacy settings.

However, the complainant had previously been given a ban on presence for a period of one year by the Sports Court.

2. Who is the controller?

The complainant lodged his complaint against the clerk of the Sports Court, whereas according to the Sports Court the clerk acted on behalf of the Sports Court. The clerk must be considered an employee of the Sports Court. Therefore, according to the Litigation Chamber, it is the Sports Court that acts as the controller, not the clerk.

3. Processing of personal data?

The Litigation Chamber then checks whether this is a processing of personal data. The Sports Court stated that it was not a processing activity, because it was not a so-called structured processing. However, this exclusion of the GDPR only applies to manual processing. In this case, however, it was an automated processing via e-mail and the GDPR therefore continued to apply

4. Was the processing lawful?

4.1 Distinction between consultation and re-use of public photo 

Subsequently, the question arises as to which legal basis from the GDPR the Sports Court was allowed to process (i.e. the forwarding to third parties) these personal data (i.e. the profile photo). 

First and foremost, the Sports Court had had a bailiff establish that the profile photo was publicly accessible on the complainant's Facebook profile. The complainant, too, now confirmed that “everyone knows that a profile picture is freely accessible” [free translation].

A distinction must then be made between (1) consulting and (2) re-using this public profile photo. After all, the fact that a profile photo can be consulted publicly does not necessarily mean that this profile photo can also be re-used for another purpose.

4.2 Legitimate interest of the sports court and the three-step test

For the re-use of the profile photo, the Sports Court relies on its legitimate interest. In order to ascertain whether that is possible, the Litigation Chamber follows the cumulative three-step test developed by the Court of Justice of the European Union (CJEU) in the Rigas^[1] case .

1. Purpose test:

• Meaning: is it a legitimate interest?
• Decision of the Litigation Chamber: the Litigation Chamber states that the execution of a judgment of the Sports Court is a legitimate interest.
• Interim decision: purpose test fulfilled.

2. Necessity test:

• Meaning: is processing necessary to achieve this purpose?
• Decision of the Litigation Chamber: according to the complainant, the sports commissioners themselves had to look up his profile photo on Facebook and his profile picture should not have been edited either. However, the Litigation Chamber states that the profile photo was edited in order to make other persons unrecognisable. This was therefore a correct application of the principle of data minimisation. Furthermore, the Litigation Chamber refers to recital 39 of the GDPR and states that, in the present case, the purpose could not reasonably be fulfilled by any other means than the processing of the profile photo. 
• Interim decision: necessity test fulfilled.

3. Balancing test:

• Meaning: is the balancing of interests in favour of the controller?
• Decision of the Litigation Chamber: it must be evaluated whether the complainant could reasonably expect that processing could take place for that purpose at the time and in the context of the collection of personal data. The Litigation Chamber states that the profile photo was made public by the complainant himself and that this processing is therefore within his reasonable expectations. In addition, the judgment of the Sports Court stated that the clerk of the court was requested to inform all organisers of competitions on Belgian territory of the ban on presence. Subsequently, the Litigation Chamber stated: “Although the judgment does not require that a photograph of the complainant be added to this notification of the ban on presence, it is necessary, however, for the purposes of verifying compliance with the prohibition of presence on the part of the complainant, that the organisers of matches on Belgian territory have at their disposal some means, i.e. the photograph of the complainant, in order to be able to identify him if necessary - in the event of non-compliance with the ban”. [free translation]
• Interim decision: balancing test fulfilled.

5. Decision of the litigation chamber

In view of the above and that each test of the three-step test has been completed, the Litigation Chamber decided that the Sports Court was right to invoke its legitimate interest in the re-use of the profile photo of Facebook in question. The complaint was therefore dismissed.

^[1] ECJ, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA "Rīgas satiksme", recital 28. See also ECJ, 11 December 2019, C-708/18, TK t/ Asociaţia de Proprietari bloc M5A-ScaraA, recital 40.