The Lithuanian SA adopted a decision on the actions of the organisation on the processing of children’s image data

Background information

• Date of decision: 30 September 2022
• National case
• Controller: Public organisation
• Legal references: Consent as a legal basis for the processing of data (Article 6(1)(a) GDPR), conditions for consent (Article 7 GDPR)
• Decision: The complaint was found to be well-founded and the corrective actions provided for in Article 58(2) of the GDPR have been taken

Summary of the Decision

Origin of the case

The applicant lodged a complaint with the State Data Protection Inspectorate (hereinafter - the Inspectorate), in which she stated that, in order to register her daughter to the camp, she had to accept the contractual clause that the child would be photographed and filmed and her image would be used on social networks and other sources where the organisation or its programmes are advertised. The applicant stated that she had contacted the camp organiser (hereinafter - the Organisation), indicating that she did not agree with such a contractual clause, but that she had received a reply stating that the contract would not be amended and, if the applicant did not agree to such terms, registration was not possible.

During the examination of the complaint, the applicant provided additional information in which she stated that she had registered the child to the camp (received confirmation of successful registration) and informed the Organisation by email on the same day that she wished to withdraw her consent to photographing, filming the child and using her image for advertising purposes. The organisation gave an answer to the applicant that “the payment has been returned and you will not be admitted to the camp because of such conduct and communication”.

Key Findings

The Inspectorate found that data subjects (including the applicant) did not in fact have the opportunity to freely choose whether or not they could refuse or withdraw consent without incurring damage. The consents of the data subject being collected by the organisation did not meet the “freely given” criterion. Similarly, such “consent” included in the provisions of the Contract did not meet the other requirements of the GDPR for consent - specificity, information, unambiguousness, form and revocability. Although the Organisation adjusted the form of the Contract during the examination of the complaint, however, the amendments made were not sufficient, and it was found that parents who did not give their consent to the taking of photographs of children and using their images on social networks would still suffer significant negative consequences.

In addition, data subjects were not allowed to give separate consent to individual operations of personal data processing. Moreover, the applicant could not exercise her right to withdraw consent without suffering negative consequences. It was found that both the procedure for obtaining consent and the withdrawal of consent did not meet the requirements of the GDPR for consent as a legal basis for data processing.

Decision

The actions of the organisation in the processing of children’s image data without the consent of the data subject meeting GDPR requirements, the failure to provide for free choice and the impossibility to withdraw consent without suffering damage, as well as the failure to give separate consent for individual operations of personal data processing led to the infringement of the principle of lawfulness and the conditions of consent (Article 5(1)(a), Article 6, Article 7 of the GDPR).

The Inspectorate recognised the applicant’s complaint as well-founded and took the corrective actions provided for in Article 58(2) of the GDPR.

For further information: https://vdai.lrv.lt/uploads/vdai/documents/files/Sprendimas%20sutikimas%20tvarkant%20vaiku%20atvaizdo%20duomenis%202022-09-30.pdf