"Kiss cams" and personal data protection

1 Last week, a Coldplay concert in the United States of America was marked by an unusual moment, which quickly made headlines around the world.

The aim was to capture the image of a couple of spectators embracing during the band's performance using a kiss cam. A tool that, as the name suggests, aims to capture romantic moments: first, by identifying potential "in love" couples among the audience; then, by "inviting" them to kiss. All this while broadcasting the moment live on a giant screen—to the delight of the general audience and, usually, the people they are watching.

It turns out that, in this case, the couple "caught" on camera were coworkers having an extramarital affair, unknown to their respective partners (both were married). Hence, contrary to what would be expected under "normal" circumstances (at least by American standards), their reaction was not one of joy, but rather panic—to the point that Coldplay's lead singer felt the need to intervene, embarrassingly stating that he hoped he hadn't messed up ("I hope I didn't do something bad") .

The damage, however, was already done: in the internet age, images of the moment quickly went viral; and its protagonists were soon identified. This, in addition to all the impacts projected on their personal and family lives, even led to one of the couple resigning from the professional position they previously held, where they earned an estimated annual salary of over $670,000.

2 To be clear: it is not the purpose of this article to reflect on the morality of the conduct of the aforementioned couple – which, as is evident, is condemned and disapproved of.

The aim is something quite different: to focus the discussion on the issue of legality. Or, more precisely, to answer a question we, as legal scholars, have been grappling with since the moment we first witnessed the images that (almost) everyone is talking about today. And that question is this: would such a thing be legal in Portugal?

In other words: in Portugal, could the use of kiss cams during public events be considered compatible with the current regulatory framework – in particular, with the principles and rules set out in the relevant applicable data protection legislation?

3 Let's start at the beginning: the capture of images relating to identified or identifiable individuals undoubtedly constitutes a personal data processing operation, within the meaning of Article 4(2) of the General Data Protection Regulation (hereinafter referred to as the GDPR). This means that, to be lawful, it must necessarily meet at least one of the six conditions of lawfulness set out, exhaustively and exhaustively, in Article 6(1) of the same Regulation.

In this regard, Article 6, paragraph 1, letter a), of the GDPR provides, as the first of these conditions, that the processing of personal data should be considered lawful “if and to the extent that (…) the data subject has given his or her consent (…)”. This, on first reading, could lead the reader to conclude that the answer to the question we previously posed had been found: since the capture of images, using kiss cams , was preceded by a request for consent from the data subjects (the viewers); and since that consent was actually given, this operation should be considered lawful.

However, to be valid, consent must be expressed as a “free, specific, informed and unequivocal expression of will (…)” (cf. Article 4, paragraph 11, of the GDPR). These requirements make its use as a legal basis for processing particularly challenging – not to say impractical – in a context such as the one at issue here.

Firstly, because, in order to be qualified as an “unequivocal expression of will (…)”, consent must be given by means of a clear positive act – which excludes the possibility of it being obtained tacitly, through the silence or omission of data subjects (in this sense, see recital 32 of the Regulation). Secondly, because, in order to constitute a “free expression of will (…)”, consent must correspond to a “genuine choice” (cf. EDPB, “Guidelines 05/2020 on consent within the meaning of Regulation 2016/679”, 4 May 2020, p. 14) – which in turn excludes the possibility of it being presented to data subjects as a prerequisite or necessary condition for accessing a particular product or service (such as, by way of mere example, a ticket to a show).

To all this, there is also, and finally, a profound logistical problem: how to identify, among a universe of tens—or even hundreds!—of thousands of people, those who consented to having images taken and those who did not? Is it possible? It might be, eventually ( e.g., by assigning different colored wristbands to each of these types of spectators; placing them in different locations within the venue). Feasible? We doubt it.

4 In view of this, the only admissible way to legitimize a personal data processing activity similar to that in the Coldplay case, in our view, is for it to be classified under art. 6, no. 1, al. f), of the GDPR; a provision which states that the processing of personal data should be considered lawful “if and to the extent that (…) it is necessary for the purposes of the legitimate interests pursued by the controller or by third parties (…)”.

However – and similarly to what we have seen in relation to consent – the point is that invoking this basis also presupposes the fulfillment of certain requirements – specifically, three cumulative requirements, namely: (i) the existence of a legitimate interest of the data controller or of a third party (which may, in this case , consist of improving the experience of the audience present, through their greater involvement in the show); (ii) the need to process personal data to achieve that interest (which will oblige the event promoters to demonstrate that that objective cannot reasonably be achieved in an equally effective manner through other means that are less harmful to the fundamental rights and freedoms of spectators); and (iii) the requirement that the interests or fundamental rights and freedoms of the data subjects do not prevail over the interests of the controller or of third parties (which will ultimately involve a weighing up of the opposing rights and interests at stake, taking into account the concrete circumstances of the particular case) (cf. CJEU, Judgment of 4 July 2023, Meta Platforms and others, Case C-252/21, §106).

If these requirements are met, however, there appears to be no reason to prevent the capture of images using kiss cams in the context of shows such as concerts (or similar events) from being considered in accordance with the requirements of our legal system.

This interpretation is reinforced by the provisions of art. 79 of the Civil Code, where although it is established as a rule that “the portrait of a person cannot be exhibited, reproduced or launched into commerce without their consent” (no. 1), it is then exceptionally established that “the consent of the person portrayed is not necessary (…) when the reproduction of the image is framed within the context of public places, or of events of public interest or that have taken place in public” (no. 2) – except, it should be noted, “if the fact results in harm to the honor, reputation or simple decorum of the person portrayed” (no. 3).

5 Thus—and by way of summary—the answer to the question with which we began this text is simple: in Portugal, the use of kiss cams may appear to be lawful. However, for this to happen, their introduction must be preceded by a careful analysis.

This analysis should, in particular, allow for the identification of the risks that the use of these tools may pose to the fundamental rights and freedoms of data subjects, as well as the definition of measures to reduce the likelihood and impact of such risks to an acceptable level (e.g., informing potentially targeted individuals about the possibility of their image being broadcast live on giant screens in the venue; broadcasting during quieter periods, such as breaks, to reduce the degree of exposure of these individuals to third parties; creating "camera-free" zones where those who do not wish to be filmed can move during breaks; limiting the time during which images are broadcast on giant screens; among others). After all, while it is true that in public spaces, each individual's "expectation of privacy" should be considered lower, this does not mean that it should be considered non-existent. To assume otherwise would be to open the door to a dystopian reality, similar to that experienced by Winston Smith in Orwell's 1984 . With one aggravating factor: in this case it will not be fiction, but reality.

Note: the opinions expressed in this article are formulated on an individual basis and are not binding on the entity in which the author works.