Using a recording of a meeting without consent - GDPR experts?

[particularsrequired]

My daughter's class teachers recently organised an information evening for parents. Unbeknown to those present, one of the parents recorded the meeting, and posted it to the parents' WhatsApp group. Like others, I discovered that it had been recorded when I saw the post (the teachers didn't know either). Now there's another meeting this week. The parent who did the recording can't go, and she's asked that someone else do it this time, and post it in the WhatsApp group, for her and anyone else who can't attend. (The teachers always email a summary afterwards, so the recording isn't the only way of finding out what's happened).

I have a problem with this; not only do I not like the idea of recording these meetings and making the content public (because once it's in the WhatsApp group it could be shared with anyone), I also think it's illegal. My passing acquaintance with the GDPR tells me that explicit consent from all those present is required if the recording is for anything other than personal use, but I may be wrong. I'd really like to hear from anyone with a more solid knowledge of this area.

Maybe I should say that we're not in the UK, but we are in the EU, so the GDPR applies here in the same way as in the UK. I'm asking here because endless googling hasn't given me an answer, and I don't know where to ask the question in the country we live in, where there is no equivalent to MN.

Thanks in advance.

This happened to my DH. A parent recorded him giving the usual "meet the teacher" thing at the start of the school year. She asked about it going on FB/WhatsApp and he said no. I was appalled that she thought it was ok to record him covertly. He's really not keen on social media. I think it's a ridiculous thing to do. Email the school.

Legal or not it’s so wrong

community.tes.com/threads/parent-recording-conversations-without-permission.783273/
not exactly the same but relevant comment ie she can record meeting BUT she made it public on whats ap without permission that is against privacy laws. What would worry me is this: was there any way of identifying other parents or any private comments made that might expose parents/childs privacy for instance where a child/parent is at risk or a fostering situation where a childs protected new address might be exposed.

Not a qualified lawyer, but...

GDPR applies to any "natural or legal person" (ie either an individual or a corporation) which collects/processes personal data so it's not strictly companies only that it applies to.

Personal data is information which relates to an identified or identifiable natural living person. That means the recording could contain personal data in this situation if - essentially - you can reasonably tell who is being talked about. We'd need more detail on what the content of the recording is to be able to say whether it contains personal data.

Consent also isn't the only lawful basis for data processing. One of the other grounds is 'legitimate interest', so the other parent might argue that there is a legitimate interest in making sure others know what happened at the meeting. But one of the steps in applying that basis is that the processing is necessary to achieve the goal - so if the information about the meeting is available through alternative means, it may not apply.

'Domestic' data processing (not done for any commercial or professional reasons) isn't covered by the GDPR but it must be 'purely' for personal purposes, and it seems that data protection authorities/courts interpret that according to factors like whether the people being recorded were strangers to the person recording and whether the recording was taken in a public place or not. This is a pretty fuzzy test at the moment because the GDPR hasn't been in force for long enough for the EU Court of Justice to have made any decisions about it yet.

Basically it's hard to tell whether the GDPR would actually apply here, but it does seem like there's a risk of it. If it did, it's unlikely that there's a lawful basis for the processing. However, if it IS purely domestic processing, the GDPR wouldn't apply.

It's perhaps worthwhile asking the school to say to the people recording that there is at least a risk of infringing the GDPR - and even if it doesn't, if it's known that people are uncomfortable with it then surely it defeats the purpose of keeping other parents happy!

(NB you may have separate laws about secret recordings/distributing recordings/etc which aren't to do with the GDPR - but that depends what country you live in as PP have said.)

@bacabu yes it applies to individuals in relation to how organisations hold and process data

If any child or children are specifically named then I am fairly sure that that specific person who shared this without permission can be charged for breaching privacy rules, etc....

@particularsrequired do you plan to attend the meeting?

We had this at a school pta meeting a few years ago. A sensitive issue which was under investigation, and a parent with a track record of disruption/challenging behaviour, who was observed switching on voice memo then putting the phone on top of her bag on the floor. At the next meeting, I said before proceedings commenced that I didn’t consent to being recorded; another parent said the same; then a third; so that it would have been impossible to do so. Maybe you could consider saying ‘I’m aware that somebody may have recorded a previous meeting, and I wish to state I don’t give permission to record me’.

@banjaxxed not just individuals within organisations - see for instance www.dataprotection.ie/en/cctv-home - it's about what individuals do with the data not just whether they're part of an organisation

It applies to individuals if they process personal data for non- domestic purposes. Like sole traders, for example.

Thanks again for all your replies. I know it's a bit odd me asking about a legal issue in a country which I haven't named and where most of you don't live, but it's still helpful. I've got some ideas to follow and some links to click, so thanks for that. And I'm glad to see that many of you agree with me that, legal or not, it's just not on, so I feel a bit less of a loon (I think they see me as that weird British mother with her funny ideas).

Yes, personal info was certainly given out last time (a new teacher introduced herself, for example, but there were also things about named children - the kind of things parents are happy to share in the setting of an informal meeting but wouldn't necessarily expect to go any further), and I would expect the same to happen tomorrow.

As I said in my OP, the teachers email the main points to all parents afterwards, so this isn't the only way of getting the info. TBH, I can't believe many people (anyone?) actually listened to the recording last time, and the chances of it having been sent beyond the WhatsApp group are slim, but that's not the point.

The meeting is tomorrow, and I am planning to go. I've decided not to email the school beforehand, as I know from experience that nothing will be done. Instead, I'm going to ask at the start of the meeting whether it's being recorded, and object if it is. The stupid thing is that the likelihood of me saying anything sensitive that I wouldn't want a record of is almost zero, so I'm not even doing this to protect myself. I just think it's wrong (and hugely disrespectful of the teachers in particular). Of course, in objecting I will confirm my status as weird foreign mother, but so be it. You never know, maybe other parents will follow my lead.

GDPR addresses common concerns that people have, particularly with respect to their children's data and their own. Regardless of country.
Can't help you being the weird foreign mother but there is a lot of info on the website of the UK regulator in English .
There is also some in French and Spanish but I'm not sure that's GDPR specific.