Dear Atty. Kathy,

As foodies, my partner and I made it a tradition to dine in a new restaurant every weekend. We enjoyed eating at this new restaurant, NR, last weekend, that we wanted to recommend it to our families and friends. I searched for the NR’s social media account for the purposes of sharing the same with our friends and families. I was therefore surprised when I saw a closeup picture of me and my partner in NR, being sweet and looking happy while having our meal. I want to complain to NR that they violated our privacy by taking and posting the picture without our consent. My partner thinks we should not complain anymore since there is nothing bad about the picture and we were in a public place. Wasn’t our privacy violated when the NR posted our picture without our consent?

Robin

□□□□□

Dear Robin,

National Privacy Commission (NPC) Advisory Opinion No. 2021-014 Re: Posting of Photo in a Social Media Platform Without Consent mentions that protection to the right to privacy extends to public spaces. In other words, a person’s data privacy rights do not cease even when one is in a public space.

Based solely on your narration, your picture was taken without your knowledge and then posted online without your consent. According to NPC Advisory Opinion No. 2018-051, if you were candidly and secretly photographed then your photos were posted online, the same may be considered as unauthorized processing for being in violation of your privacy rights, since the taking and posting of your photos were without your consent. In such cases, you are entitled to order the removal of your picture from the social media account of the restaurant.

It bears stressing that according to the NPC recording is different from posting. When recording in a public space, one can take photos or videos if there is sufficient basis, including, for security, documentation, news, or personal use (when filming a family member or friend). What is important is that there is a legitimate purpose, and what is being recorded does not exceed this.

Posting, however, is a different story, and likewise required legal basis. Your face and identity are considered personal data under the Data Privacy Act of 2012 (DPA). The legal basis could be consent, or other grounds such as legitimate interest, particularly if the posting is in the public interest. There are also situations that are not covered by the DPA, such as purely personal use and legitimate journalism.

In sum, having sufficient basis for recording does not automatically provide a basis for posting. Separate and sufficient basis must be provided for each.

Atty. Kathy Larios