Comment by amiga386
8 hours ago
This is not the case at all!
GDPR Article 2(2)c "This Regulation does not apply to the processing of personal data: by a natural person in the course of a purely personal or household activity". If you're photographing/videoing for yourself (non-commercial), an exception for you already exists. You don't need to become a data controller for all the incidental people in your holiday videos.
But if you upload the video to YouTube... Google is the data controller, and billions of unnamed, unknown individuals are its data subjects. Courts have ruled that even if you post on social media and you're restricting it to friends & family, that falls under the individual/household exception, but if it's viewable to all, GDPR applies.
Google doesn't need to discover who these people are. That would be bad in and of itself (Article 11: Processing which does not require identification)
But if a data subject does contact Google, and can confirm they are the specific person in a video, they can get their Article 13/14/15/16/17/18 rights... which are subject to the other exceptions you mention.
It's true that if it falls within household exemption then GDPR doesn't apply. However household is exemption is narrow.
For example CCTVs that point to public street are not within household exemption scope even if you are only doing it personal protection.
In the context of this app the video was taken and posted to YouTube for everyone to see. So it would no longer be within household exemption -> the original author would have needed to fulfill their GDPR obligations.
And in regards to Article 11, that does not give exemption for Article 13/14, only for 15-20.
Platforms tend to rely on Article 14(5)(b), but I don't think that it would often hold up if challenged. CJEU puts a lot weight on Article 13/14 since they the primary ways for data subject to even find out about the processing. And if they don't find out the processing they cannot effectively exercise their other rights.
What you're saying sounds insane. You're saying that a person taking a photo/video in public -- EVERY person doing so -- has to identify EVERY person in the photo/video, and inform EVERYONE of their rights, etc.... if they upload it to YouTube or Flickr?
I don't believe they do. That would be massively disproportionate. Show me they do, show me even a single tourist being prosecuted for not informing every street passer-by behind them in their selfie-stick video of their data rights.
The law has been applied at e.g. commercial photographers (who make contractual agreements with the intended subject in the photo because they want to make full use of the subject's identity, e.g. advertising), CCTV (notice has to be given) and events (where people are informed there is filming and they can choose not to be in it), but the public in public filming the public? (in general, and not specific people) It has not happened to my knowledge.
If the law were applied like you say it is, the only legal filming in public would be to CLOSE the area to the public and have no members of the public in public. Like a film set, where the only passers-by are paid extras who signed a release. That's completely untenable.
I can't speak for member states laws, I only know one country's laws, but in the UK, this simply wouldn't be done. The reasoning would be that providing such data subjects with information about the data processor would be IMPOSSIBLE. The data processor (tourist) has absolutely no idea who any of the people in the photo/video are, and never will.
My understanding is that when videos are uploaded to YouTube, the fact Google is publishing it makes Google the data processor, and Google's duties are fulfilled by not seeking to identify the people in the video, but offering them their rights nonetheless should the data subject be able to identify themselves.
Try using a dashcam in Austria and see if they're serious or not.
There is https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C%2F05%2... for example. While it didn't touch Article 13 itself it did touch 2(2)(c). One of the reasons court gave is (machine translated, I do not speak Dutch):
> In addition, with Facebook it cannot be ruled out that placed photos may be distributed and may end up in the hands of third parties.
So court considered just that possibility as one of the aspects which led to household exemption being unavailable.
> What you're saying sounds insane. You're saying that a person taking a photo/video in public -- EVERY person doing so -- has to identify EVERY person in the photo/video, and inform EVERYONE of their rights, etc.... if they upload it to YouTube or Flickr?
They do not need to identify them, but they need to provide the sufficient Article 13 notice. That could be, for example, sufficiently clear sign that they wear. You can check C‑422/24 for what CJEU said about body worn cameras. One of the important points court highlighted is:
> If it were accepted that Article 14 of the GDPR applies where personal data are collected by means of a body camera, the data subject would not receive any information at the time of collection, even though he or she is the source of those data, which would allow the controller not to provide information to that data subject immediately. Therefore, such an interpretation would carry the risk of the collection of personal data escaping the knowledge of the data subject and giving rise to hidden surveillance practices.
And regarding:
> If the law were applied like you say it is, the only legal filming in public would be to CLOSE the area to the public and have no members of the public in public. Like a film set, where the only passers-by are paid extras who signed a release. That's completely untenable.
It can be legal to film in public, but it either requires using the derogations and applicable Member State laws (like artistic expression exemption) or making sure you actually give that Article 13 notice. Or truly just use it for household use.
Of course these things are not normally enforced unless someone actually files a complaint.
[EDIT] since I forgot to address this point
> My understanding is that when videos are uploaded to YouTube, the fact Google is publishing it makes Google the data processor, and Google's duties are fulfilled by not seeking to identify the people in the video, but offering them their rights nonetheless should the data subject be able to identify themselves.
Processing is evaluated per processing operation. YouTube itself is controller for many of these. These could, for example, include actually surfacing the video via algorithm. The important decisions here are C‑492/23 from last year and C-188/24 from this year.