The recent decision of the Swiss Federal Tribunal (EDÖB v Google, Trib. Admin. Fed.) against Google Street View has raised new and important questions for many industries, not least for other enterprises that use photography of individuals in countries subject to data protection laws based on the EU model.
In the Google case, the Swiss Court reaffirmed the EU Working Party 29 position that images of people constituted “personal data” because they made individuals distinct and identifiable, and that consequently data protection laws applied. Given the provisions of these laws, the court chided Google for improperly collecting Street View data originally and then subsequently failing to fully anonymize this data before publication. Although the court acknowledged that Google had blurred “up to 95% of faces and license plates” photographed, this remained insufficient. Even when blurred, photos of individuals near “sensitive places” (such as women’s shelters) remained a serious concern for the court.
European views on privacy have, in the past, run headlong into journalistic efforts. Those watching the development of European privacy law under Article 8 of the European Convention will recall the result in a case brought by Princess Caroline of Monaco, who won a landmark ruling in 2004 preventing the German press from publishing photographs of her and her children while in public places — photographs that would be entirely permissible under the laws of the United States and many other countries. But the Swiss case does not appear to add new burdens for journalists.
The Swiss court found that the Swiss data protection regulator’s enforcement action against Google was appropriate and justified in part because of the “sufficiently widespread” scale of the risk created by Google’s practices, which contrasts with the smaller scale on which photojournalists routinely operate. Additionally, and more importantly for most EU Member States, Article 9 of the Data Protection Directive (Directive 95/46/EC) specifically provides for exemptions from data processing laws for personal data processed “solely for journalistic purposes.” This does not mean journalists are entirely off the hook, however — any processing of personal data must remain “necessary to reconcile the right to privacy with the rules governing freedom of expression,” so a balancing act by the press is still required. But this particular case should not make the balance more difficult to accomplish.