Recording and Posting Third Parties on Social Media: What Does the GDPR Say?

Recording and Posting Third Parties on Social Media: What Does the GDPR Say?

Social media has made it incredibly easy to capture and share moments from everyday life. However, this often includes recording third parties in videos or stories without any prior permission. Due to the increasing number of such incidents lately, I looked into what the GDPR and the Cypriot legal framework provide, particularly Law 125(I)/2018, which applies in Cyprus and regulates matters related to the implementation of the GDPR.

To begin with, a person’s image, and by extension any video in which an individual can be identified, is considered personal data. As a result, recording someone and, more importantly, uploading that material onto a platform constitutes “processing” under the GDPR. The Court of Justice of the EU has made it clear for years that publishing material online amounts to processing through automated means.

A recurring question is whether the so-called household exemption applies; this exemption covers processing carried out purely for personal or household activities (Article 2(2)(c) GDPR). From what I have read, this exemption is interpreted very narrowly. It does not cover situations where the content is accessible to a large or undefined number of people. Put simply, if a video is uploaded in a way that anyone can view it, it is unlikely to qualify as a “purely personal activity.”

If the GDPR does apply, the next question is whether the publication is lawful. For processing to be lawful, one of the legal bases under Article 6 GDPR must be present. In most everyday scenarios, there is no consent from the person appearing in the video, and there does not seem to be another lawful basis that would justify the upload. The fact that someone originally posted a video or photo of themselves does not mean they consent to further redistribution by third parties.

Finally, if a video is posted without permission, the person appearing in it may request its deletion, object to the processing, or even file a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus. The general position is that posting videos of third parties without their consent is rarely compatible with the GDPR.

However, Article 6 GDPR does provide certain limited situations where personal data may be processed lawfully without consent. These include cases where processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject’s request prior to entering into a contract; where processing is necessary for compliance with a legal obligation of the controller; or where it is necessary to protect the vital interests of the data subject or another natural person. However, these are exceptions that apply only in very specific circumstances and are unlikely to be relevant in the context of everyday social media posts.