Hacker News Reader

Comment by galadran | Hacker News Reader

This would be illegal in the EU under the GDPR which would require positive consent from the individuals monitored (simply walking into a space would not be enough). However, individual countries are allowed to alter this aspect of the Regulation themselves, so effectively countries may now "opt in" to the use of facial recognition in more settings. Quite different from the opt out relationship of the US States.

Source: https://www.lexology.com/library/detail.aspx?g=c0714997-42b1...

View on HN

So how does that work when I'm in a park taking pictures to share on my public Instagram? Do I need to get a model release from each person that walks into my frame? What defines monitoring?

Article 2: "This Regulation does not apply to the processing of personal data [...] by a natural person in the course of a purely personal or household activity".

The recital associated with that explains it: "This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities."

It sounds like GDPR wouldn't require you to get a release...but it might require Instagram to require you to get a release.

So that means if I plan to sell prints of my photos, I would have to get releases even though I didn't want a person in my shot, but the nature of it being a touristy place, people are inevitably in the shot. Take this photo for instance[1].

1: https://megapickles.photo/2018/06/03/dumbo-washington-street...

The GP's link is helps define it. Apparently on second access it becomes paywalled, but the gist is photos become personal information when "specific technical means" are used to identify individuals.

I think Instagram's suggested tags etc would count, so presumably they'll have to turn that off in the EU.

However, I think your vacay photo snapping is safe because you're an individual. From https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-to-m...

> To fall within the remit of the GDPR, the processing has to be part of an “enterprise”.

Reply on news.ycombinator.com