Comment by buzer
11 hours ago
Generally speaking it's illegal in EU due to GDPR. The major issue is Article 13. When you obtain personal data directly from data subject (which is what would happen when you record video) you need to give them the information that Article 13 requires.
Basically the only exceptions to this come from Article 23 (which is unlikely to apply) and Article 85. Article 85 covers "journalistic purposes or the purpose of academic artistic or literary expression", but it requires separate law in Member State and these then set out the requirements what actually qualifies under it. The standards for that tend to be much stricter than US' First Amendment (which allows essentially anyone to say that they are press).
This is not the case at all!
GDPR Article 2(2)c "This Regulation does not apply to the processing of personal data: by a natural person in the course of a purely personal or household activity". If you're photographing/videoing for yourself (non-commercial), an exception for you already exists. You don't need to become a data controller for all the incidental people in your holiday videos.
But if you upload the video to YouTube... Google is the data controller, and billions of unnamed, unknown individuals are its data subjects. Courts have ruled that even if you post on social media and you're restricting it to friends & family, that falls under the individual/household exception, but if it's viewable to all, GDPR applies.
Google doesn't need to discover who these people are. That would be bad in and of itself (Article 11: Processing which does not require identification)
But if a data subject does contact Google, and can confirm they are the specific person in a video, they can get their Article 13/14/15/16/17/18 rights... which are subject to the other exceptions you mention.
It's true that if it falls within household exemption then GDPR doesn't apply. However household is exemption is narrow.
For example CCTVs that point to public street are not within household exemption scope even if you are only doing it personal protection.
In the context of this app the video was taken and posted to YouTube for everyone to see. So it would no longer be within household exemption -> the original author would have needed to fulfill their GDPR obligations.
And in regards to Article 11, that does not give exemption for Article 13/14, only for 15-20.
Platforms tend to rely on Article 14(5)(b), but I don't think that it would often hold up if challenged. CJEU puts a lot weight on Article 13/14 since they the primary ways for data subject to even find out about the processing. And if they don't find out the processing they cannot effectively exercise their other rights.