Slovenian SA orders the controller to delete a collection of 88 photos according to Article 17 of the GDPR

14 September 2021

Background information

Date of final decision: 28.6.2021
Cross-border case or national case: national case
Legal Reference: Right to erasure (Article 17)
Decision: Order to comply
Key words: Freedom of expression, Legitimate interest, Right to privacy

Summary of the Decision

The controller, a media content production agency specializing in journalistic and photographic work in the field of lifestyle, was processing a collection of 88 photos, taken during the last 7-15 years, representing the data subject attending different social events. The photos were published on a website and were also offered for online sale. The individual exercised her right to erasure (right to be forgotten) defined in Article 17 of the GDPR. She did not give consent to the processing of her personal data and emphasised that she objects to processing of her personal data and that no compelling legitimate grounds for the processing exist. The controller refused her demand mainly for the following reasons: the processing is needed for exercising freedom of expression regarding his media activities, public right to information and on the grounds of legitimate interests according to (6) (1) (f) GDPR.

Slovenian SA found that all photos considered represent personal data which is a part of a filing system. From the thumbnail and the description of photos which were accompanied by the first and last name of the individual, it was possible to determine which event the individual attended, who was her company and her personal characteristics (for example her physical characteristic, mood, appearance…). When entering the search string in the website search engine the website could create a person’s profile. The content of the website cannot be understood as reporting on a specific event, because it enables a search on the basis of first and last name. The website also contained no information regarding Articles 12-14 GDPR, which is an important element in demonstrating individual’s expectation of the processing on the grounds of the legitimate interests of the controller.

Slovenian SA decided the controller must delete all the photos from the website, together with name of the individual, URL address and metadata that enabled access to photographs. Right to the protection of personal data needs to be balanced with the freedom of expression and information. To justify an interference with the right to privacy, the controller should have demonstrated strong public interest or justified reduction of expectation of privacy. Publications are intended only for revealing interesting information for “curious readers” which seek information about public events and on personal lives of a specific person. The content of the website did not contribute to debate of social importance or relate to a topic of public interest. The individual was also not an absolute public figure. Finally, the controller also failed to demonstrate its legitimate interests. For the reasons outlined, the Slovenian SA decided to uphold the complaint.


The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.