There’s obviously exceptions, and it matters whether the person is incidental to the composition or the primary subject of it, but I think that’s a pretty good approach as a default.
On a related note, it's still quite jarring for me to read the full name of perpetrators, victims, or witnesses involved in more or less newsworthy events in American media – the culture and (informed by that) law around what personal information is considered acceptable to be published is very different.
On an EU level, this concept even goes as far as being explicitly confirmed as a "right to be forgotten", which has implications for e.g. web search engines.
just to name a few
Here is a cool chart with consent requirements in different countries.
On the other hand, that table heavily clashes with https://en.wikipedia.org/wiki/Personality_rights at a first glance, e.g. for Greece ("no consent required for taking a photo" vs. "Taking a picture of a person in a public space: Requires consent."), so I'd take it with a large grain of salt and not consider it legal advice.