3 ms·

The user who posts the photo is a data controller, and it is her obligation under GDPR to remove the photo when requested. All data processors in the chain (the

by Geee 9y ago

The user who posts the photo is a data controller, and it is her obligation under GDPR to remove the photo when requested. All data processors in the chain (the photo app, cache, host, etc.) have to provide the means for the data controller to remove the image. That's my understanding for user-generated content which may or may not contain personal information.

PeterisP 9y ago
No, the users aren't data controllers, the GDPR does not apply at all to any acts of natural persons in the course of purely personal activity, and GDPR does not apply any obligation to that user (other laws, however, may do that). It does, however, apply to the organization storing that photo - since the default case is that they're forbidden to do that, and as article 6 point 1 (https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/) states, processing is lawful only if one of the listed conditions apply. It does seem that interpretations handling user-generated content will be tricky, and likely would require additional legislation to clarify that, which is a common scenario for such laws.
- Geee 9y ago
  https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ 7. ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; 8. ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; You are right though that GDPR doesn't apply to non-business individuals, but that doesn't make the image host the data controller. Maybe the user and the host are data controllers 'jointly'? Dropbox is quite clear that at least in their Business and Education accounts, the account owners are data controllers for all their data.

by Geee 9y ago

PeterisP 9y ago

No, the users aren't data controllers, the GDPR does not apply at all to any acts of natural persons in the course of purely personal activity, and GDPR does not apply any obligation to that user (other laws, however, may do that). It does, however, apply to the organization storing that photo - since the default case is that they're forbidden to do that, and as article 6 point 1 (https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/) states, processing is lawful only if one of the listed conditions apply. It does seem that interpretations handling user-generated content will be tricky, and likely would require additional legislation to clarify that, which is a common scenario for such laws.

Geee 9y ago
https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ 7. ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; 8. ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; You are right though that GDPR doesn't apply to non-business individuals, but that doesn't make the image host the data controller. Maybe the user and the host are data controllers 'jointly'? Dropbox is quite clear that at least in their Business and Education accounts, the account owners are data controllers for all their data.