Other use of profile photos: legality fair-use and permissions

Question

I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). To make these images visible on the web if the user works on a browser, I upload the profile photos from the user's phone to a server, and deliver them to the web app.

To support OTHER users, if they do not have a profile photo on their phone, I intend to display the first one that was uploaded, which came from somebody else's phone.

The app asks for permission to use the users phone book. And there is fine print that the profile photos will be used in this manner.

Irrespective of the fine-print, is this 'acceptable use'? Am I opening my company to some risk?

Answer 1

BAD idea

It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook.

It isn't a fair use of the phonebook pictures - and you might not have a license anyway, as some people associate photos with numbers that they don't have a license to associate with anyway.

But what if instead of a photo of the person, the first photo someone associated with the person is a photo of something like... crack cocaine, a photo of someone in a very compromising situation, just genitals, or some other thing that is just as tasteless or possibly criminal to share? In that case, your company is possibly committing defamation, and in case sharing or possessing of the image itself is illegal, your company is now the actor and liable. Depending on the content of the picture, distribution of pornographic material (possibly even underage material of that sort) could be up that alley just as much as hate speech through symbols, usage of banned symbols (such as swastikas in Gernamy) and many many others.

Answer 2

Super illegal

Just focusing on the GDPR, what is your legitimate basis for taking the personal information of a third-party?