How restrictive is the General Data Protection Regulation (GDPR) in Europe? Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission to everyone that appears on the picture? If I witnessed or I am the victim of any type of agression or abuse on the street or at work, I cannot record it because I will face legal consecuences?
Technically, yes, GDPR might apply. Filming other people does involve the processing of personal data, and GDPR will apply unless this is for “purely personal or household purposes”. But exactly that will be the case for most holiday snapshots or short clips for your personal social media. As far as I understand, you do not have to worry about purely personal activities. Even if GDPR would apply, this doesn't mean it would be illegal. It means you'd need a “legal basis”, such as a “legitimate interest”. If there are just a couple of people in the background of a video, it's possible that their rights might weigh less important than your interest in shooting the video – but that would need a case by case analysis. Your legitimate interest would almost certainly prevail if you need to record a crime to which you are victim. Regardless of GDPR concerns, note that this is just a small aspect of legal concerns. Instead, also consider personality rights copyright (if art or architectural works are visible) / freedom of panorama customs and reasonable expectations of other people These issues will depend largely on the specific country or area you are travelling to. Europe is not homogenous in its perception of privacy issues. For example, consider the issue of dashcams in a car. These are considered to be quite normal in some European countries, but effectively illegal in others.
If you can’t stand the heat, get out of the kitchen The thrust of this question, as well as many others you have posted, seems to be looking for a way of avoiding your obligations under the GDPR because they are difficult, onerous and/or expensive. Too bad! You don’t have the option of which laws you comply with and which ones you don’t. If I had my choice, I’d comply with the GDPR and not with tax law, but I don’t so I can’t. You have 3 simple choices: Do your best and insure the rest. This means learning what’s required and implementing it to the best of your ability and taking out appropriate insurance cover to deal with any mistakes you make. Ignore the law and hope you don’t get caught. Don’t release apps.
As stated in the answer to What is considered &quot;public&quot; in the context of taking videos or audio recordings?; if either of the participants is in Australia than unless all parties have given consent then the recording is illegal. Notwithstanding its legality, property in the recording vests in the person who made it. There is no law against him keeping it. There is no law against him publishing it unless the material contained is offensive, hate speech or defamatory (see Customer feedback gathering in Australia).
I live in the EU and Facebook has blocked access to my account unless I accept their privacy rules, which means giving up GDPR protections. Facebook operates in the EU and has EU data subjects, therefore Facebook is subject to GDPR. You should be able to withdraw your consent. Article 7(3) says: The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.
It depends. Can the data controller or another person, with &quot;means reasonably likely to be used,&quot; (see clause 26 of the preamble of the GDPR) use that data alone or in combination with other data to identify a natural person? If yes, it is personal data within the meaning of the GDPR. If no, it is not personal data within the meaning of the GDPR. Anonymous data is not subject to the GDPR. &quot;The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.&quot; Assigning an unique alphanumeric code to a thing does not necessarily make the code and/or the thing &quot;personal data&quot;. But if you have a set of data that is or can be linked by the unique alphanumeric code (e.g. as a primary key in a set of tables) and you can use it to identify a person, then it is personal data. Either way, to be GDPR-compliant / to mitigate risk you should make some kind of record to reflect that process of thinking and what you decided. And if the answer is Yes, it is personal data, then you should record your &quot;lawful basis&quot; for processing the data and how you decided that.
This issue touches upon two distinct GDPR rights: Art 15 right to access: you have a right to receive a copy of all personal data concerning you that are undergoing processing (including storage). Access may only be denied where this would “adversely affect the rights and freedoms of others.” Art 20 right to data portability: if processing is being carried out by automated means, and processing is based on certain legal bases (consent or contract, but not legitimate interest), then you have a right to receive a copy of your personal data in a machine-readable format, for personal data that you have provided to the data controller. Whereas the right to access is fairly straightforward, the right to data portability applies under much more narrow conditions. Basically, it's a right that you can download any data that you've uploaded so that you can move to a different service. Google Takeout is primarily concerned with your right to data portability, and provides your data in a machine-readable format. Any photos that you've uploaded to Google Photos, you'll be able to download. Thus, it could be technically compliant to exclude information that they've inferred about your personal data, such as image-recognition results. Such results would still be personal data under the GDPR definition of the consent, and would be covered by your right to access. Google might argue that you already have access to this data through the web interface. In my opinion the GDPR clearly requires the data controller to provide a “copy”, i.e. the data in some durable form – not merely access through a web interface. Whereas your question is specifically about Google, the same issue applies to other services as well. E.g. Ruben Verborgh has an interesting blog series on trying to get access to all their data from Facebook, though unsuccessful so far. Similar to your scenario, Facebook offers a download for personal data but does not include all personal data in this download. In one of the documents provided by Facebook in the course of the exchange, they note that they allow access to photo tags through the web interface, but do not include this in downloaded data – without providing further justification.