The Finnish Data Protection Board recently granted Google a permit to process personally identifiable information in its Street View service. This is in line with the Board’s previous practice as established in its Fonecta decision earlier this year, where the Board held that photos in street view services showing people’s faces and license plate numbers are considered personal data, the processing of which is regulated by the Finnish Personal Data Act. This would be the case even when people’s faces are ultimately blurred out – as in Google’s Street View service – since the photos are collected, stored and processed in an identifiable form before the blurring effect is applied.
Under the Personal Data Act, processing personal data always requires a specific statutory basis. The Act includes an exhaustive list of grounds for processing personal data, at least one of which must be applicable to the situation at hand. Such statutory grounds include, e.g., the express consent of the people whose data is being processed, a pre-existing customer relationship or, ultimately, a specific permit issued by the Data Protection Board.
In this case, Google has no direct relationship with the people whose pictures might appear in the Street View service. Thus, Google applied to the Data Protection Board for a permit to process street view photos potentially containing personally identifiable information. Taking into account the fact that the data was stored in an identifiable form for a limited time only, the limited role the personal data played in the service, and that the service could be deemed ‘socially significant’, the Board decided to approve the application and issue a permit valid until July 2014, after which Google will have to re-apply.
The Board did, however, attach three conditions to the permit:
- Google must always blur out people and vehicles so as to render them unidentifiable;
- Google may only store identifiable raw data until the final street view has been assembled; and
- Google may not release raw data to any third parties.
In its Fonecta decision, the Board issued a permit to a similar service with the same conditions. The Board therefore now appears to have a relatively consistent approach to street view type services.