PROCESS APPLICABLE TO REQUESTS FOR DELETION OF VIDEOS CONTAINING PERSONAL DATA

This document describes the current process applicable to requests for the deletion of videos that contain 3^rd party personal data, ex. when your image, name or voice are present in videos published by Users of the Dailymotion Service.  

Even though it makes reference to the GDPR (i.e. European Union law) it is addressed to the residents of the EEA (EU Member States, Norway, Liechtenstein, Iceland) and other countries having data protections laws substantially similar to the GDPR (ex. United Kingdom, Switzerland).  

More protective measures are applied to sensitive personal data and to personal data belonging to minors as further explained in the FAQ below. 

What does the law say? 

The GDPR, in its chapter 3, provides Data Subjects with several rights, including the right to request deletion of their personal data. 

This personal data deletion right can be exercised by a DATA SUBJECT, i.e. an individual residing in the EEA and requesting deletion of his / her own personal data. A Data Subject’s request must be addressed to a DATA CONTROLLER, i.e. to an individual or an entity that determines the purposes and the means of processing personal data. A Data Controller has 1 month to reply to a Data Subject request. This delay can be extended by additional 2 months if necessary. 

While processing personal data, a Data Controller may rely on the services of third parties called DATA PROCESSORS. Data Processors process personal data only on instructions and for the purposes determined by Data Controllers. GDPR does not authorize a Data Processor to reply to personal data deletion requests.  

For full definitions of the terms used in the GDPR please refer to its article 4.  

Who-is-Who when it comes to videos available on the Dailymotion Service? 

Dailymotion is a content hosting platform, i.e. Dailymotion does not publish the videos that are present on its Service. A decision to post a video on our Service belongs exclusively to its Uploader – i.e. a channel owner. An Uploader decides what video to post on the Dailymotion Service, when to do so and in which territory.  

When a video contains personal data, it is the Uploader who determines the purpose and the means of processing of that personal data. Consequently, the UPLOADERS are DATA CONTROLLERS of any personal data contained in videos that they post on the Dailymotion Service. 

Dailymotion only provides technical means to Uploaders (basically, video file hosting and streaming technologies) to be used when Uploaders decide to make their videos available to the public. When a video available on the Dailymotion Service contains personal data, Dailymotion is a DATA PROCESSOR for processing of that personal data.  

When a video available on the Dailymotion Service contains personal data of a natural person residing in the EEA that person is a DATA SUBJECT.   

To be considered a PERSONAL DATA DELETION REQUEST, a request to delete a video must (i) identify the notified video (i.e. contain its url), (ii) identify the personal data that a video contains (ex. my image/name appears at 1minute 32 second of a video), (iii) be accompanied by documents reasonably confirming that a requestor is the Data Subject, i.e. that personal data contained in the video belongs to the requestor, and that the requestor is a resident of the EEA (ex. an official ID), (iv) be addressed to the Data Controller and, also (v) contain information on how to communicate with a requestor (ex. your email address). 

How does it work in practice? 

• A GENERAL RULE: A Personal Data Deletion Request must be filed by a Data Subject, i.e. a person whose personal data (image, voice, name, etc.) is contained in a notified video, and be addressed to a Data Controller, i.e. an Uploader of that video / an operator of a channel on the Dailymotion Service. 

• HOW TO FILE A PERSONAL DATA DELETION REQUEST: You may always file a Personal Data Deletion Request directly with the Data Controller. Many channel owners post urls of their websites on their Dailymotion channel pages allowing you to contact them directly. You may also file your request through the intermediary of Dailymotion if you’re not able to contact the Data Controller. Being a Data Processor and thus not authorized by the GDPR to process your Personal Data Deletion Request, we will transfer it to the Data Controller. 

• WHAT DO I NEED TO PROVIDE TO DAILYMOTION: you need to provide all information and documents that are part of a valid Personal Data Deletion Request as described above, i.e. identify the video and the Data Controller (video url), identify the personal data contained in that video (describe whether it is your image, voice or other data and give the exact time stamp when it appears in the video), provide evidence that you are a Data Subject i.e. that this personal data does belong to you and that you are an EEA resident (ex. a copy of your official ID). When you authorize someone to file a Personal Data Deletion Request on your behalf (ex. e-reputation agency, lawyer, etc.), that person will also need to provide us with a valid authorization to represent you (ex. power of attorney). 

• WHAT WILL DAILYMOTION DO WITH MY PERSONAL DATA DELETION REQUEST: as a Data Processor we are not competent to process your request. Upon receipt of a complete Personal Data Deletion Request, we will transfer your demand and contact details (ex. an email address you used to contact us) to the Data Controller, i.e. to the Uploader of the notified video. You can ask us not to communicate your contact details to Data Controller in which case we will inform the Data Controller of your decision and transfer any replies to you.  Note that, as a rule, we will not communicate your IDs to the Data Controller. Instead, we will inform the Data Controller that we did receive copies of your IDs and that we reasonably established that you are indeed a Data Subject. However, an Uploader does not have to rely on our verification. As a Data Controller, an Uploader may decide to independently proceed with verification of your identity and request your IDs (or other documents) to do so. In such case, unless you oppose to it, we will communicate these IDs (or other documents) to the Uploader. Your opposition to such communication may prevent a Data Controller from confirming that a deletion request comes from a Data Subject (i.e. from a person whose personal data is included in a notified video). Consequently, a Data Controller may refuse to treat your request as a GDPR Personal Data Deletion Request. 

• HOW DO I OPPOSE TO DAILYMOTION’S SHARING OF MY CONTACT DETAILS WITH DATA CONTROLLER (UPLOADER): when you file a Personal Data Deletion request though the intermediary of Dailymotion, we confirm it receipt while explaining our role and applicable process. If you don’t want Dailymotion to communicate your contact details to the Data Controller, you can inform us about your decision by replying, within 72 ours of receiving it, to that message.  In the absence of your timely opposition we will communicate your contact details to the Data Controller. 

• HOW WILL I RECEIVE UPLOADER’S / DATA CONTROLLER’S DECISION: when your contact details are known to the Data Controllers, they may answer you directly.  Data Controllers may decide to communicate their decisions through the intermediary of Dailymotion. Data Controllers have 1 month (extendable by additional 2 months) to answer your request.  

• WHAT IF A DATA CONTROLLER DOES NOT ANSWER MY REQUEST: In general, the mere presence of personal data in a video does not make it unlawful. Even when you have not consented to it, presence of your personal data in a video may be justified by another legal basis (ex. legitimate interest or contract). However, the absence of an answer from a Data Controller to a valid Personal Data Deletion Request is a breach of a legal obligation by that Data Controller. When a request you file through the intermediary of Dailymotion is a valid Personal Data Deletion Request (i.e. when it contains all the elements required under the GDPR) and a Data Controller does not respect its GDPR obligation to answer you within the statutory deadline, then the notified video becomes unlawful. In other words, by not answering you, a Data Controller fails its legal (GDPR-imposed) obligation to identify a legal basis justifying presence of your personal data in that video, thus rendering that video unlawful. Despite not being owners of the videos present on their services, content hosting platforms have authority to deactivate access to videos that they know to be unlawful. As a result, being a video hosting platform, Dailymotion deactivate access to videos whose Uploaders do not comply with their legal obligation to reply to a valid data subject request. Consequently, if an Uploader does not reply to you, Dailymotion will deactivate access to a video your have notified to us. 

FAQ: 

• A video contains personal data of my child. Can I request its deletion?  A child’s parent or legal guardian  is authorized to act on behalf of their child. To do so, they must reasonably show having parental rights over a child whose personal data is contained in a notified video (for detailed description of the applied process please refer to our Help Center article). 

• A video contains information about my company. Can I request its deletion? No, the GDPR applies only to personal data of natural persons. Companies do not benefit from the GDPR deletion right. However, if you believe a video to be unlawful for another reason you can always report it using our Service’s report feature.     

• Can I ask for deletion of personal data belonging to a friend or a family member? As a rule, only a Data Subject, i.e. a person whose personal data is included in the video, can ask for its deletion. However, Data Subjects may authorize someone else to file requests on their behalf. In practice, if you file a request on behalf of someone else, you will need to show that the personal data contained in a video belongs to that person and that you are duly authorized to act on behalf of that person. 

• What if the personal data included in a video belongs to a minor or is sensitive data? Sensitive personal data (ex. health data) and personal data belonging to minors require enforced protection. For that reason, and as an exception to the general process, while pending processing of your request by Data Controller (i.e. by the Uploader of a notified video) we will temporarily block access to a notified video on our platform (for detailed description of the applied process please refer to our Help Center article).  

• What will Dailymotion do with my ID? We only use your ID to verify that your request is a Data Subject request. We verify the authenticity of the document, confirm that the name in the ID corresponds to the name you use in correspondence with us and to the actual personal data contained in a video. If you state that your image is present in a video, we will also examine your ID’s photo to verify that statement. The results of these verifications are recorded in our files and the copy of ID is destroyed once your request is closed (i.e. upon the final decision of a Data Controller or, in the absence of a reply from a Data Controller, upon our deletion of a video). 

• How is my ID protected? When we ask you to communicate your ID to us, we ask you to send us a selfie with that ID (with details allowing verification of your identity visible). This serves two security purposes, to confirm that it is indeed the owner of an ID that sends it to us (to help detect the use of stolen IDs) and to limit the risk of future fraudulent use of the ID (selfies are often not acceptable formats for administrative purposes). We also advise you about alternative technical protective measures such as watermarking, as described here, or generating unique-use copies as described here (both in French only). When we share your IDs with Uploader, we do so using a time limited access solution. We do not send them by email but, instead render them available for consultation and / or download for a limited period of time (72 hours, renewable on request) on a dedicated document sharing platform.  

• If Dailymotion is not a Data Controller, why do you ask for so much information and so many documents? When someone files a Personal Data Deletion Request, the main objective is to stop the accessibility of that data on our Service. As a content hosting platform, Dailymotion does not decide which videos to publish on or delete from our Service. Our control over accessibility of content is limited to the deletion of content that is manifestly unlawful. The mere presence of personal data within a video is not manifestly unlawful. GDPR provides several possible legal basis for personal data processing that may justify presence of your personal data in a video (even in the absence of your consent). For instance, the right to information may be a valid reason to publish a news video containing your personal data. It is Data Controllers who establish a legal basis justifying the presence of personal data in videos they publish. Dailymotion has no right to do so. We can, however, deactivate access to a video that we know to be manifestly unlawful. Providing us with a valid Personal Data Deletion Request (and in particular, confirming that you are an EEA resident and that personal data present in a video belongs to you) turns an absence of Uploader’s reply into a non-compliance with a Data Controller’s legal obligation to process a Data Subject request. It is because you showed us that your request is a valid Personal Data Deletion Request that, in the absence of Data Controller’s reply, a notified video becomes unlawful, and we can block access to it. If you decide not to provide us with all required information, we will not know whether your demand is a valid Personal Data Deletion Request that imposes an obligation on a Data Controller to answer it. You may still ask us to transfer your request to the Uploader. However, because of your decision not to provide all the information, we will not know whether, by not replying to you, an Uploader failed to comply with its GDPR obligation to answer a valid Personal Data Deletion Request. Consequently, we will not know whether a video you wish us to delete becomes an unlawful one.