In our blogpost "Relationships in the workplace", we looked at aspects of employment law in the context of the "kiss cam" case, which continues to cause a stir and has taken further exciting turns. In this post, we would like to take a closer look at data protection issues:

In the United States, the principle of "reasonable expectation of privacy" applies. In a stadium full of cameras at a major concert, it will be deemed rather small. By contrast, the EU approach is fundamentally different: Even video recordings of identifiable persons made in public constitute personal data within the meaning of Article 4(1) GDPR and are therefore subject to protection under the GDPR.

All data processing must fulfil the conditions for lawful processing. As a consequence, in addition to the principles of processing under Article 5(1) of the GDPR, all processing of personal data must be based on a legal basis under Article 6(1) of the GDPR. 

As regards the images of persons shown on large screens, such as kiss cam broadcasts, two legal foundations come into play: consent pursuant to Art. 6(1)(a) GDPR or legitimate interest pursuant to Art. 6(1)(f) GDPR. Whether these justifications constitute suitable legal foundations or not is something which always needs to be examined on a case-by-case basis.

If public broadcasts allow for conclusions about particularly sensitive characteristics such as sexual orientation, health status or ethnic origin, special categories of personal data within the meaning of Article 9 GDPR are concerned. Processing such sensitive data requires explicit consent (implied consent is not sufficient).

The use of a "kiss cam" at a concert in Austria is problematic in any case. Organisers are therefore required to ensure that data protection rules are complied with before using such a "kiss cam". 

If you have any questions about how to make your events compliant with data protection regulations, the KWR Data Protection Team will be happy to help.