Guide about posting pictures and video on social media

Private images or videos identifying a natural person should not be posted via social media or any other online platform without the consent of the data subject.

Publishing personal data on the such platforms exposes individuals to risks of their fundamental data protection rights and may also cause real damage and harm to effected data subjects, namely loss of control over their personal data. This action may constitute an infringement of GDPR, unless the processing of personal data is not undertaken by a person specifically in the course of a purely personal activity.

Therefore, pictures or videos shared directly on a personal one to one basis through private chat, and which would not have been made available elsewhere, fall outside the scope of GDPR. However, the situation changes if the information is made available on a publicly available source or used for purposes which clearly go beyond the personal scope.

The purpose of the data shall be considered before any posting material, including personal data, online. When a person posts information or a video identifying a natural person on an open social media profile, such upload would need to satisfy one of the lawful criteria for processing stated under Article 6(1)  GDPR, e.g. obtaining consent from the individual appaering in the image.

Without a lawful ground, the upload would constitute an infringement of data protection rules, and the individual will, as a result, have the right to request its deletion, initially, with the person or organisation uploading the images, and with the relevant social media platform.

The data subject has also the right to exercise the applicable remedies contemplated in Chapter 8 GDPR, namely filing a complaint with the IDPC, filing a claim for compensation before the competent Court and seeking judicial redress.