Europe: uploading photos of other individuals requires their consent

[euractiv] Tagging photos on social networking websites may soon become an ordeal for aficionados of Facebook, MySpace and the like, as EU privacy regulators recommended imposing strict rules on users uploading pictures of other individuals on their personal pages.

An opinion issued by the group of European privacy watchdogs states that users of social networks "should only upload pictures or information about other individuals with the individual's consent". If applied, this provision would completely alter the way such websites work today.

Currently, social networking members share pictures and tag friends' images without requiring their prior consent. Moreover, Facebook or MySpace users tend to communicate publicly, putting their and others' private information on shared boards or 'walls'.

These activities would become outlawed if the recommendation of national watchdogs were transformed into legislative measures. Regulators went further and recommended that social networks should clearly inform their users about the potential privacy risks of uploading private information. In addition, "the homepage should contain a link to a complaint facility covering data protection issues for both members and non-members," reads the opinion.

The group also advised imposing limits on retaining the data of inactive users. "Abandoned accounts must be deleted," said the council of EU regulators, known as the Article 29 Working Party .

All the recommendations were based on the principle that social networking websites must fall under the strict EU Data Protection Directive, "even when their headquarters are outside of the European Economic Area".

The group's opinions are not binding, but represent an important indication of future legislative action at national and EU level. Recently the group has focused on privacy issues related to search engines, triggering a wave of actions from lawmakers and the actors involved. Under pressure, the giants of the sector, such as Google, Microsoft and Yahoo!, agreed to reduce the retention period of data they collect about their users.

The group also drew attention to the processing of personal data on the Internet for commercial purposes. They recommended obtaining the prior consent by users before collecting data aimed at personalised advertisements. The European Commission quickly backed this line, threatening strong measures to regulate online tailored and behavioural ads

EU privacy regulators eye online social networks
see also Opinion of Art. 29 WG