Fairhurst v. Woodard – the GDPR and Personal Use of Data

Since the GDPR came into force, one of the grey areas has been the personal use of data. This means there is a question about how far people can intrude into other people’s privacy for personal reasons. For example, filming yourself in a public space and uploading that video to social media will probably mean capturing footage of other people in your video. How far does the GDPR, as set out in the Data Protection Act 2018, apply to this kind of personal processing?

Purely Personal Processing

The GDPR was meant to give people control over the processing of their data and put obligations on data processors to protect privacy and improve data security. Article 2 of the UK GDPR* is clear that it “does not apply to the processing of personal data by an individual in the course of a purely personal or household activity”. This in effect means that the GDPR applies to commercial, government, research, and other areas of data processing, without needing ordinary people to seek permission every time they wanted to post a picture or share a video online.

However, as the recent case of Fairhurst v. Woodward (F and W) shows, there are limits to what is reasonably within the scope of “purely personal or household activity” and the phrase does not give people a free hand to record and process whatever data they want.

The case centres on two neighbours whose properties backed on to each other over a communal car park. One neighbour put up a range of internet-connected audio-visual equipment that the other felt intruded unreasonably on their privacy. In this post we’ll focus on two items:

• a video doorbell on or near F’s front door that captured footage of people as they walked past
• a motion-activated light, camera and microphone overlooking the car park that could see/hear into W’s back garden and parking spaces.

W objected that these devices intruded into her privacy, and over time the relationship between F and W broke down, so the matter made its way to court.

Interestingly, in deciding whether or not to accept F’s argument that the devices were there for personal security, the judge took into account the privacy principles.

The Court’s Findings

The judge found that:

• a motion-activated light does not in itself raise privacy issues, as being in light or darkness is not a matter of right
• having your property overlooked by another property does not automatically give rise to privacy concerns
• the doorbell would only capture the data of people walking past W’s house incidentally and does not raise privacy concerns that override W’s legitimate interests in home security
• the range and scope of what the camera and microphone could capture were excessive and W could have fulfilled his need to protect his home and property in lesser ways.

What is interesting here to us is that the Judge relied on the privacy principles and the lawful bases for processing data when deciding what was reasonable in terms of processing data for personal use (in this case home security). Ultimately, the decision means that when setting up recording devices such as cameras and microphones, people must:

• be careful that the scope of the recording, like the amount of data they record, and the area covered, is reasonable and proportionate
• consider the limit at which their legitimate interests are overridden by the potential intrusion into other people’s privacy.

To us, it feels as if the matter could have been resolved much sooner, if F had considered the first privacy principle; being open and transparent. If F had discussed and agreed with W what he planned to do, then a reasonable compromise could have been reached which is always ideal between neighbours.

Personal Use of Data: What next?

More importantly, this judgement confirms the idea that there are no limits to what people may do in terms of recording and processing data when acting in a personal capacity – but there are limits to the scope of what is “purely personal”. The only framework we have to decide where those limits lie in each case are the privacy principles. This is particularly important because it is in line with other cases, both at home and across Europe, that have historically viewed the line between someone’s personal privacy, and a person’s freedom to act in a personal capacity, should be drawn in the favour of privacy.

That means:

• be open and transparent with anyone who might be more than incidentally affected by what you are planning
• make sure you strictly limit your data collection – what you video, or record for example – to what is necessary
• make sure you are clear about why you are collecting data e.g. home security
• keep any recordings, and your internet or WIFI connection as safe and secure as possible
• don’t keep videos, images, or audio recordings for longer than necessary
• don’t share anything you do record with anyone who doesn’t need it, including posting it on social media.

*The UK GDPR is an amended version of the GDPR that has been brought into UK law to underpin the Data Protection Act 2018 and allow continuity once the UK ceased to be a member of the EU.