Case number:
Antecedent: NAIH/441/2021.
To
Dear Sir/Madam,
Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data
Protection and Freedom of Information, hereinafter: Authority) had earlier informed you that the
Slovak Data Protection Authority (hereinafter: Slovak Authority) objected to processing carried out
by (hereinafter: Foundation or controller) as the presumed controller
of the websites and .
In view of the fact that both website are Hungarian language sites, have a domain name registered
in Hungary and, furthermore, the operator of the websites i.e. the controller, has its registered office
in Hungary, the Authority designated itself as the lead authority in the procedure initiated by the
Slovak Authority to identify the lead supervisory authority according to Article 56 of the General
Data Protection Regulation 1.
According to the Slovak Authority, the processing with regard to content accessible at the following
links
presumably breaches the provisions of Article 5 and 6 of the General Data
Protection Regulation.
The recordings feature children performing and singing specifically from the
and children from other Slovak, Hungarian
and Romanian schools.
The Authority watched the recordings and found that their mode of presentation is not individual,
the children perform a group programme on stage and the group photos made were uploaded to
the websites. Sensitive information on the data subjects were not shared. In this context, the
1
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC. The regulation can be
accessed here: https://eur-lex.europa.eu/legal-content/HU/TXT/HTML/?uri=CELEX:32016R0679&from=EN
Authority also notes that no complaints objecting to the processing were launched, instead the
Slovak Authority launched a procedure ex officio.
The Authority disagreed with the Slovak Authority and its draft decision of 24 August 2020 informed
the Slovak Authority of its position, according to which the information available does not make it
likely that the provisions of the General Data Protection Regulation referred to were breached,
hence it did not launch an inquiry in the case. However, the Slovak Authority raised objections
against the Authority’s relevant draft decision of IMI , arguing that in contrast to the wording
in the Authority’s draft decision, it was irrelevant whether a photo showed a crowd or the depiction
was unique, and also noted that the content objected to was still accessible on 10 September 2022.
It declared that a “national complaint” was lodged against the school, because the school published
a few photos and videos on the Internet without the consent of the parents. In its objection, the
Slovak Authority emphasised that it disagreed the Authority’s position according to which the
available information does not give rise to a suspicion of unlawful processing by the Foundation on
its websites. Furthermore, according to its position, it has to be established whether the Foundation
uploaded any of the objectionable contents (photos or videos) and it has to justify the legal basis
of processing and if there is no legal basis, it is necessary to issue a notice against the Foundation,
calling it to remove the data processed without a legal basis. In view of the reasons detailed above,
the Slovak Authority repeatedly expressed that in its view, there is a possibility of infringement,
hence it is necessary to conduct an inquiry.
The Authority found that the recordings objected to are no longer accessible on the internet.
The Authority reviewed the websites concerned in this inquiry and based on the information on the
websites and the statements of the Foundation found the following in relation to the Foundation’s
activities:
The is a Hungarian language
initiative on the occasion of the Earth Day. The participants of the initiative sing the song Light a
candle for the Earth together in Hungarian. The purpose of the initiative is to use music to educate
children about sustainability, and through that to educate them about environmental culture i.e. to
shape their lifestyles, thinking and behaviour. According to the initiative “music is a wonderful
instrument with the help of which attention can be directed to a sustainable and fair world view for
human society, nature and the planet, and to finding a way to lead us to a more beautiful future”.
The initiative connects Hungarian communities in all parts of the world and directs their attention to
the love of the Earth.
According to the information provided by the Foundation, the programme
(hereinafter: programme) is an experience-based educational methodology built on psychological
research. The programme addresses the psychological wellbeing of both teachers and children,
moreover, it provides an opportunity for the involvement of parents. It can be an excellent
supplement to preschool or school work, because it provides an opportunity for bringing the
traditional sharing of knowledge in line with the development of personal and social competencies
needed for life. In every month of the academic year, the programme reflects on a subject matter,
which will support and help children in dealing with everyday problems and develop their personal
and mental health skills through continuous self-awareness and techniques intensifying a sense of
happiness.
2
The goal of the is not to present a problem-free life model to the young, but to
provide guidelines to children of preschool and school age to enable them to face challenges more
easily, to overcome problems and to provide an opportunity for studying the factors needed to
maintain bodily and mental health and to raise awareness concerning these.
Institutions can join the network of by submitting an application.
Although the Hungarian Authority disagreed with the need for an inquiry, granting the request of
the Slovak Authority, it launched an inquiry based on Article 57(1)(h) of the General Data Protection
Regulation and Section 38(3)(a) of Act CXII of 2011 on the Right to Informational Self-
Determination and the Freedom of Information (hereinafter: Privacy Act), in the course of which the
Authority contacted the Foundation based on Article 58(1)(a) and (e) of the General Data Protection
Regulation 2 and Section 54(1)(a) and (c) of the Privacy Act 3.
In view of the objection raised by the Slovak Authority to the Authority’s decision, in its inquiry
procedure the Authority examined what role the Foundation had in relation to the processing
objected to by the Slovak Data Protection Authority and whether there was an infringement of
Articles 5 and 6 of the General Data Protection Regulation.
Upon the request of the Authority, the Foundation - through , president of
the Board – provided detailed information on the processing objected to in its statement of 4
January 2021 and 20 October 2021.
The Foundation created the program. Individual teachers, as well as educational
institutions, may join the programme; joining is conditional upon participation in the
network. Those teachers who would like to join the programme individually
have to complete the thirty-hour accredited course run by the Foundation, which provides an
adequate basis for acquiring the methodology of the .
The website was created on the occasion of the Earth Day
in 2017 and was still active in 2018. The initiative can be joined either individually or in a group by
registering on the website.
The programme was introduced and represented by the
(hereinafter: School) in Slovakia based on the cooperation agreement concluded
2
Article 58(1)(a) and (e) of the General Data Protection Regulation: “Each supervisory authority shall have all of the following
investigative powers:
a) to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide
any information it requires for the performance of its tasks.
[…]
e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance
of its tasks.”
3
Privacy Act Section 54(1)(a) and (c): “In the course of its inquiry, the Authority
a) shall be given access to, and may make copies of, all data processed by the controller under inquiry that are presumed to relate
to the case at hand, and shall have the right of access to, and may request copies of, such documents, including documents
stored in an electronic data medium,
[…]
c) shall have the right to request written or oral information from the controller under inquiry, and from any employee of the
controller.”
3
with the Foundation. There was a title awarding ceremony for the Slovak institutions in the first half
of 2019, in which the representatives of the schools participated and, inter alia, children gave
performances. The Foundation shared the photos made at this ceremony in the news reporting on
the ceremony. The Foundation presented that it was not aware that the school did not obtain
consent to making and using the photos of the persons participating in the ceremony, particularly
in view of the fact that the face of one of the participants was blurred out upon request. Further,
requested by the , the Foundation deleted the content
objected to.
It was the Foundation’s idea to enable users registering with the programme to upload reports
illustrated with photos and videos , as well as persons joining the initiative to upload photos and
videos to the website related to the specific programme and initiative. The Foundation informed
users of the possibility to upload on the websites and .
According to the Foundation’s position, it acted as processor and not as controller with regard to
the processing under inquiry, in view of the fact that all it provided was an interface for uploading
photos and videos on both the websites and . As the operator
of the websites, the Foundation pursues only the tasks of a moderator, i.e. it deletes entries that
may constitute infringements; however, the entries are published not by the Foundation as they are
uploaded to the websites by the users. Persons uploading content may delete them from the
website at any time. The Foundation underlined that the schools uploaded the videos objected to
to YouTube, and the YouTube videos were only embedded as external content on the websites.
The Foundation stores the photos and files uploaded by the users to the websites on its server
protected by SSL encryption and exclusively authorised persons may have access to these data
through the password protected admin interface of the website, others cannot edit them, only view
them. The Foundation’s administrator can delete the uploaded materials. Only the dedicated staff
member of the Foundation has access to the server of the websites. The Foundation underlined
that only the appropriately authorised staff members of the Foundation can see and edit the
personal data of users through the admin interface, except for the password which is stored in an
encrypted format.
The Foundation stores the recordings on its server until they are deleted by the uploading user, or
if it is an infringing content, it is immediately deleted once the Foundation becomes aware of it.
Further, the Foundation stated that it did not pursue processing with regard to the recordings
involved in this case, but with regard to the other personal data processed by them in the context
of the websites, they guarantee the exercise of data subject’s rights in line with the General Data
Protection Regulation and their Privacy Statement was available on both websites. In the Privacy
Statement accessible on the programme’s website, the Foundation emphatically called attention to
the fact that by uploading a photo/video containing the image of a third person, the uploading
person assumes responsibility for obtaining the prior written consent of any person displayed on
the photo/video and, in the case of children below the age of 16, the legal representative of the
child must consent to making a photo/video recording of him/her and his/her child below the age of
16 and also to having the photo/video shared on the website.
4
The Foundation stated that the Privacy Statement related to initiative did not
include the provision concerning responsibility for the legal basis of processing the personal data
of the data subjects; however, the Foundation maintained its statement, namely that it is the
responsibility of the person making the photo or the video recording to obtain the consent of the
data subjects, i.e. to have the appropriate legal basis partly in relation to making the recording and
partly with regard to its publication, and according to the Foundation’s position this responsibility
exists irrespective of whether the Foundation specifically draws the attention of the publisher of the
photo/video to this fact.
The Authority reviewed the Privacy Statement published on the programme’s website and found
that Section 4.4 of the Privacy Statement contained the following: “Registered members can share
reports of the classes they held, illustrated by photos and/or videos on the page “The Children’s
Works” of the portal. (...) We emphatically call attention to the fact that by uploading a photo/video
containing the image of a third person, you assume responsibility that in the event of using the
image of all the persons in the photo/video or in the case of using the image of a child below the
age of 16, the legal representative of the child, must give his/her written consent in advance to
having a photo/video recording made of him/her or the child below the age of 16 and also to sharing
the photo/video on the portal.
The Foundation attached a copy of the cooperation agreement concluded with the School on 2
May 2018 concerning participation in the programme. The Foundation informed the Authority that
no document was signed by the Foundation and the School, which would have laid down the
decision-making competences related to the determination of the purposes and means of
processing.
I. The jurisdiction of the Authority
In the course of clarifying the fact of the case, the Authority established that the processing under
inquiry can be associated with the Foundation registered in Hungary and the School in Slovakia.
Pursuant to Article 55 of the General Data Protection Regulation and Section 38(2)(a) of the Privacy
Act, the jurisdiction of the Hungarian Authority covers the Foundation which has its registered office
in Hungary, consequently the Hungarian Authority is not authorised to investigate processing by
the School. In view of all this, the Authority only investigated processing by the Foundation in this
procedure.
II. Establishing the capacity of controller
II.1 Pursuant to Article 4(1) of the General Data Protection Regulation, “personal data”
means any information relating to an identified or identifiable natural person (“data subject”); an
identifiable natural person is one who can be identified, directly or indirectly, in particular by
reference to an identifier such as a name, an identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural
or social identity of that natural person.
II.2 Pursuant to Article 4(2) of the General Data Protection Regulation, “processing” means any
operation or set of operations which is performed on personal data or on sets of personal data,
whether or not by automated means, such as collection, recording, organisation, structuring,
5
storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction.
II.3 Pursuant to Article 4(7) of the General Data Protection Regulation, “controller” means the
natural or legal person, public authority, agency or other body which, alone or jointly with others,
determines the purposes and means of the processing of personal data; where the purposes and
means of such processing are determined by Union or Member State law, the controller or the
specific criteria for its nomination may be provided for by Union or Member State law.
II.4 Pursuant to Article 26(1) of the General Data Protection Regulation, when the purposes
and means of data processing are jointly determined by two or more controllers, they qualify as
joint controllers. The joint controllers shall in a transparent manner determine their respective
responsibilities for compliance with the obligations under this Regulation, in particular as regards
the exercising of the rights of the data subjects and their respective duties to provide the information
referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far
as, the respective responsibilities of the controllers are determined by Union or Member State law
to which the controllers are subject. The arrangement may designate a contact point for the data
subjects. According to paragraph (2), the arrangement referred to in paragraph (1) shall duly reflect
the respective roles and relationships of the joint controllers, vis-a-vis the data subjects. The
essence of the arrangement shall be made available to the data subject. According to paragraph
(3), irrespective of the terms of the arrangement referred to in paragraph (1), the data subject may
exercise his or her rights under this Regulation in respect of and against each of the controllers.
II.5 In its response to the Authority, the Foundation stated that as the operator of the website
of the programme, the page and of the website of the initiative, the page
, it does not qualify as controller with regard to the processing under investigation.
In this context, the Foundation pointed out that it does not pursue processing activities with regard
to the photos and video recordings uploaded to the websites. It is not the Foundation that publishes
recordings on the websites as they are uploaded and published by the users. The Foundation
stores the photos on the servers of the websites, while users have to upload video recordings to
YouTube and it is from there where the links are embedded on the website. Besides, it was the
Foundation that uploaded the photos made of the title awarding ceremony organised in the first
half of 2019 to the programme’s website when the photos were transferred to it by the deputy
master of the School.
II.6 When stipulating the status as controller, the Authority examined who determined – whether
independently or together with others – the purposes and means of processing, i.e. who has the
decision-making role with regard to the purposes and means of processing.
II.7 According to the Foundation’s statement, the programme was created by the Foundation
and the initiative is also linked to the name of the Foundation. The programme was introduced by
the School and also represented by it in Slovakia based on the cooperation agreement concluded
with the Foundation. It was the Foundation that provided the possibility of uploading photos and
videos for the users for both the and the websites; it was also
the idea of the Foundation that persons participating in the programme or joining the initiative can
upload photos and videos to the websites linked to the specific programme and initiative.
6
II.8 According to the Authority’s position, the Foundation over and above providing an interface
for uploading photos and videos also determined the purpose and means of processing and it
provided an interface for those participating in the programme or joining the initiative for uploading
their recordings linked to the programme and the initiative, and this interface served the purpose
of promoting the Foundation’s activities.
II.9 When determining the status of controller, the Authority also examined the issue on whose
behalf the persons making and uploading the recorders took action when making the recordings
and uploading them to the website. In examining this, the Authority found that the persons
uploading the recordings did not act on behalf of the Foundation but in their own name when making
the recordings, they uploaded the recordings in their own name, and they decided whether to make
recordings, what sort of recordings to make and whether to publish them on the websites. The
Foundation had no control over whether or not the specific institutions and individuals would
produce these recordings and upload them to the websites, the specific decisions concerning these
were made exclusively by the persons making and uploading the recordings, i.e. with respect to
the processing under investigation, the school made them irrespective of the Foundation.
II.10 According to Guidelines 07/2020 of the European Data Protection Board (hereinafter:
EDPB) (hereinafter: Guidelines)4 if the entities do not have the same purpose with regard to the
processing, then in the light of the case law of the CJEU, joint processing takes place, if the entities
concerned pursue closely related or supplementary purposes. This may arise, for instance, if
mutual benefits arise from the same processing operation, provided that each of the entities
concerned participate in the determination of the purposes and means of processing.
II.11 According to the Guidelines, decisions are considered to be coordinated as regards their
purposes and means if they are complementary and necessary to ensure that the processing is
carried out in such a way that they have a tangible impact on the purposes and means of the
processing. According to the Guidelines 5, decisions can be considered to be coordinated with
regard to their purposes and means if they are complementary and necessary for the processing
to take place in such manner that they have a tangible impact on the determination of the purposes
and means of the processing. As such, an important criterion to identify coordinated decisions in
this context is whether the processing would not be possible without both parties’ participation in
the purposes and means in the sense that the processing by each party is inseparable, i.e.
inextricably linked. It is also important to underline as clarified by the CJEU 6 that an entity will be
considered as joint controller with the other(s) only in respect of those operations, for which it
determines jointly with others the means and the purposes of the processing. Where one of these
entities independently determines the purposes and means of upstream or downstream operations
in the chain of processing, this entity must be considered the sole controller of the upstream or
downstream operation.
II.12 Pursuant to Section 1 of the cooperation agreement concluded by and between the
Foundation and the School on 2 May 2018, “based on this agreement, the parties intend to
cooperate with a view to facilitating the objectives of the Foundation (…)”. According to Section 3,
4
EDPB Guidelines, Point 60
5
EDPB Guidelines, Point 55
6 Judgment Fashion ID, C-40/17, ECLI:EU:2018:1039
7
the School undertakes to carry out the tasks set forth in the cooperation agreement with a view to
the attainment of the objectives specified under Section 1 and the Foundation provides assistance
to the School for this. Based on the content of the cooperation agreement and the statements of
the Foundation and in the light of the Foundation’s activities, the Authority found that by creating
the programme and the initiative, the Foundation determined their fundamental purposes and the
fundamental framework of cooperation with the institutions; however, the institutions joining the
programme and the initiative identified with the objectives specified by the Foundation and, linked
to the Foundation’s objectives, they became their own coordinated objectives with respect to the
programme and the initiative. Consequently, although according to the cooperation agreement, the
parties set it up with a view to facilitating the attainment of the Foundation’s objectives, the purposes
of the processing carried out based on the agreement, thus in particular, making the photos and
uploading them to the websites, are not determined exclusively by the Foundation; instead, the
School and the Foundation pursued closely related and complementary purposes and mutual
benefits arose from the same processing operation, i.e. the making of the photos and uploading
them to the websites.
II.13 Summarising the above, the joint participation in processing between the School and the
Foundation in terms of purposes was achieved by the entities concerned pursuing closely related
or complementary purposes.
II.14 In terms of fundamental means, joint participation in processing arose from the coordinated
decisions of the two entities, with the Foundation providing the interface for uploading the
recordings on the websites, while the specific decisions whether to make those recordings and
whether to upload them to the websites were brought independently by the School, irrespective of
the Foundation, and the School made the recordings themselves to be uploaded based on its own
decision.
II.15 Article 26(1) of the General Data Protection Regulation requires joint controllers to
transparently determine and adopt their respective responsibilities for compliance with the
obligations under this regulation. Hence, joint controllers have to determine who is going to do
what, by themselves making the decision on who has to carry out what tasks in order to ensure
that processing complies with the obligations related to joint processing in accordance with the
General Data Protection Regulation.
II.16 According to the Foundation’s statement, there was no arrangement between the School
and the Foundation as joint controllers within the meaning of Article 26(1) of the General Data
Protection Regulation.
II.17 The Authority records that it is not authorised to investigate the processing by the School
in view of Section I above.
II.18 The Authority established that through the fact that there was no arrangement between the
Foundation and the School within the meaning of Article 26(1) of the General Data Protection
Regulation with regard to joint processing and their respective responsibilities because the
cooperation agreement concluded by and between them did not cover the regulation of these
issues, the Foundation breached the provisions of Article 26(1) of the General Data Protection
Regulation.
8
III. The legal basis of processing the personal data
III.1 The Authority examined whether the processing investigated in the present procedure
breaches the provisions of Articles 5 and 6 of the General Data Protection Regulation.
III.2 Under Point 58 of the Guidelines, joint processing does not necessarily mean that the
individual actors have the same responsibility with regard to the same processing. On the contrary
– as also clarified by CJEU – since these actors can participate in different stages of the processing
and to different degrees, the extent of their responsibility has to be assessed taking into account
all the relevant circumstances of the specific case.
III.3 Irrespective of the fact that, based on the Foundation’s statement, the arrangement within
the meaning of Article 26(1) of the General Data Protection Regulation has not come into being
between the School and the Foundation as joint processors, in practice they actually shared the
processing activities carried out with a view to attaining the purposes of processing among
themselves: while the School produced the photos and the video recordings and uploaded them to
the websites, the Foundation assisted in achieving the complementary purposes by providing the
interface needed. The sharing of these tasks in practice implies sharing of the responsibilities for
compliance with obligations according to the General Data Protection Regulation related to the
processing activity. With respect to making the recordings and uploading them to the websites, only
the School was in a position to have a valid legal basis for processing by obtaining the consents of
the data subjects to processing, in view of the fact that the Foundation was not in direct contact
with the data subjects and did not have an opportunity to request their consent to processing.
III.4 In the Privacy Statement of the programme (Section 4.4), the Foundation expressly drew
the attention of the participants to the fact that by uploading a recording, the person doing so
assumes responsibility for getting the consent of the person in the photo/video – or in the case of
data subjects below the age of 16, his/her legal representative – to having recordings made and
shared on the website in advance. Consequently, the Foundation acted properly to ensure that
both it and the School have a valid legal basis for the processing under investigation.
III.5 With regard to the photos transferred by the School to the Foundation and uploaded to the
website by the Foundation, the Authority accepted the arguments of the Foundation that the fact
that the face of one person blurred out on one of the photos sent by the School to the Foundation
was an indication that the School took care to have a legal basis. It follows that the Foundation had
good reason to assume that the School took steps to obtain the consent of the persons concerned
– i.e. to establish an appropriate legal basis – since any person who had not given his consent to
the processing of his image was prevented from being identified by the School.
III.6 In summary, in this case the requirements set against controllers in Articles 5 and 6 of the
General Data Protection Regulation cannot be interpreted as obligations for the Foundation.
IV. Notice
9
Based on Article 58(2)(d) of the General Data Protection Regulation and Section 56(1) of the
Privacy Act 7 and taking into account the above, the Authority
gives notice
to the Foundation to meet the requirements for joint controllers in the course of its joint
processing activities in the future.
Date: Budapest, 2023
Yours sincerely,
Dr. habil. Attila Péterfalvi
President
Honorary university professor
7
Section 56(1) of the Privacy Act “If the Authority finds that there is an infringement relating to the processing of personal data or concerning the exercise of the right to
access data of public interest or data accessible on public interest grounds, or that there is an imminent threat of such an infringement, it shall require the controller to
remedy the infringement and eliminate the imminent threat of such an infringement.”
10
Delivery clause to case file number ………………………………
To:
Name and correspondence address of
To be enclosed Mode of mailing
the addressee
To
by mail with
1. - acknowledgement of
receipt
2. Archives - -
11