DPA/GDPR breach or not?/

[dx100uk]

PS the taxi company...though it wasn't them that did upload it...don't have any responsibility...are you thinking ...as they are a company...so must have 'a data..that data controller..like you and me were/are..must authorise it....

so must redact pers data.

 

...don't think so...they are not 'by default' the data controller ...the person that took the VDo is....

 

as with me...I don't film audits...I film 'the auditor' doing the audit...

 

so if I were to upload 'my' capture of 'someone' being unlawful [be that the 'auditor' or the 'subject' filmed by me in conversation with the auditor...who are the data subject, who are the subjects, and whom could complain that if I did upload what I saw needed their permission first....all the while bearing in mind..i am quite entitled to upload anything to youtube anything I film from public property which encompasses anyone I can view with my camera....the answer is no-one....

 

keep going...

[dx100uk]

what about dash cam footage.

 

What about the England fan who jumped on ambulance following World Cup win over Sweden who is then identified by police using social media to ask for footage.

 

not admissible m'laud...the person that filmed it did not ask the perpetrators permission before putting it on youtube so is invisible and didn't do it....:lol::lol:

[steveod]

Exactly. The footage was passed to police and so was covered by one of the 6 lawful reasons for processing. It could also be posted as it was for purposes of crime which has exemptions under case law and the DPA.

 

I think the issue is you all focused on expectation of privacy in public from the pre-GDPR world. The GDPR is much clearer. It’s the actual breach of the GDPR that is now possible without having to worry about expectation of privacy.

 

1.personal data is ANY and ALL data from which a person can be identified eg picture, image, video, name and address, etc. Article 4

 

2.processing means the automated processing or manual structured filing eg uploading to internet is automated processing. Printing a picture in the local rag or any newspaper is not automated processing however the storage of the images will be if they are retained. article 2

 

3.the GDPR is clear, all processing as defined above MUST have lawful basis unless it is processed PURELY for private or household reasons. Uploading a picture of the driver of a bus is not.

 

4. In order to process it must be lawful, transparent, fair. Art 5. A privacy notice is required to ensure transparency. Was the driver given one or aware of the processing?

 

5. In order to process it must be collected for specified ,explicit and legitimate reasons Art 5.

 

6. In order for ANY processing to be lawful it MUST have a lawful basis from one of the 6. Art 6. If taking video or pictures and then for the purposes of criminal activity passing on to the police then that has a lawful basis. Or if keeping the photos for personal use then that is legitimate. What is the lawful basis for uploading it to YouTube when the driver was not involved in any criminal activity?

 

7. A data subject is entitled to compensation for any damages, including distress, caused by ANY INFRINGEMENT OF THESE REGULATIONS. Art 82.nothing here limiting or requiring that compensation is not payable if the regulations are infringed just because the personal data is posted online taken from a public place

 

it all depends on the circumstances.

 

If I upload a video to youtube using my steveod account, then I have uploaded and processed the personal data under my personal capacity, and I am the data controller.

 

If I upload the video to youtube using my ACME Ltd account, then ACME Ltd is the data controller or at the very least a joint data controller as I would be acting in the capacity of the company.