Case Studies General Accountability

 

Organisation publishing alleged personal data

The DPC received a query from an individual relating to what appeared to be the unintentional inclusion of their property on an advert published by a property website. The individual advised that the property website had published on its website an image of a property for sale as well as a number of other neighbouring properties. The owner of one of these other properties was the individual that contacted the DPC.

The individual first contacted the DPC via email raising their concern and followed up a short time later with a phone call to the DPC Helpdesk. During the Helpdesk call, the individual advised the DPC that the image contained, a photograph of their house along with their address.

In response to this information, the individual was advised about the six lawful bases for processing personal data under Article 6 of the GDPR. They were also advised of the definition of personal data as set out in the GDPR; information concerning or relating to a living person who is identified or identifiable (such a person is referred to as a ‘data subject’).

The individual was further advised that while an image of a property alone may not constitute personal data, an image containing the property address as well as a house number, may entitle them to request erasure of this data from the property website. The DPC recommended that in the first instance, the individual make contact, in writing, with the owners of the property website requesting the removal of their property from the published images on the website.

Having followed the advice provided by the DPC, the individual reverted to the DPC to advise that owners of the property website had promptly complied with their request and had removed the image of their property from its website.

Key Takeaway

  • While the definition of what constitutes personal data is broad, it may not include images of a property or home when not accompanied by any other identifying information.
  • While the DPC telephone Helpdesk is available to members of the public who have data protection queries, the DPC recommends that individuals consider approaching organisations in the first instance to give them an opportunity to respond to concerns in advance of raising a complaint with the DPC.

DPC national report findings under the Coordinated Enforcement Framework for 2024

21st January 2025

In 2024, the Data Protection Commission (DPC) participated in the third coordinated action by the European Data Protection Board (EDPB) which focused on the Right of Access. This action aimed to assess the levels of awareness and understanding of the EDPB Guidelines 01/2022 concerning the right of access among data controllers. ...

FAQs