During 2020, the Regional Court of Itzehoe (Germany) enacted a judgment in case no. 10 O 84/20, under which “Google” has a legitimate interest by virtue of Article 6(1)(f) GDPR to publish images of personal property for the needs of its services “Google Maps” and “Google Earth”.

Legality of processing under GDPR

In accordance with Article 6 of GDPR, processing (of personal data) is legitimate only in case and to the extent to which at least one of the prescribed requirements has been met, including the requirement that processing is necessary for legitimate interests pursued by controller or a third party, unless such interests are overridden by the interests of fundamental rights and freedoms of the subjects of data that require protection (of personal data), in particular where the data subject is a child, as stipulated in paragraph 1, item (f) of the respective article.

Case 10 O 84/20

In this procedure, the claim was filed with regards to the satellite images published on the subject services, for which the claimant, as the person whose property (building and its surroundings) is subject to the disputed images, required that “Google” pixelates or otherwise makes unrecognizable the content of the images, stating that they contained its personal data, while “Google” was not authorised for making and publishing them.

However, the court rejected the stated claim and found that the interest of the controller in continuing to use the images outweighed the interest of the data subject, i.e., interest in making the property unrecognizable.

Namely, according to the finding of the court, there is a need of the general public to look at the world from the above by using the services of “Google” as personal data controller, while there is no particular connection between the appearance of the photographed building and other personal data of its owner (e.g., its name and address).

Legitimate interest of the controller in domestic law

Under the provisions of the Law on Personal Data Protection (Official Gazette of RS no. 87/2018) (“the Law”), which are prescribed according to the GDPR, processing shall be lawful only if one of the following conditions has been met:

• the subject of data has given consent to the processing of his/her personal data for one or more specified purposes;
• processing is necessary for enforcement of the agreement concluded with the subject of data or for undertaking the activities, at the request of the data subject, prior to conclusion of the agreement;
• processing is necessary for the purpose of adhering to the legal obligations of the controller;
• processing is necessary for the purpose of protecting vital interests of the data subject or another natural person;
• processing is necessary for the purpose of performing the activities in public interest or enforcing legally prescribed authorizations of the controller;
• processing is necessary for the purpose of exercising legitimate interests of the controller or a third party, unless such interests are outweighed by the interests or fundamental rights and freedoms of the subject of data that require personal data protection, notably if the subject of data is a minor.

In relation thereto, by application of our Law one may assume the same, e.g., when it comes to persons with residence and/or domicile in the Republic of Serbia – legitimate interest of the controller is not outweighed by the interest of the subject of data; however, the legitimate interest needs to be estimated in each particular case, which can be done by using the form prepared by our Commissioner for Information of Public Importance and Personal Data Protection (available here).

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.