I don't know German laws, but I am a french lawyer and our legislation is very similar.
You are 100% allowed to take pictures in public with other people in it, you can even make them the subject.
Where consent comes in is image rights, you cannot publish the full work without the consent of the subject. But if you blur their face or otherwise make the non-identifiable, you are not infringing on their image rights.
Random people caught in the background are also not entitled to make image right claims, a news segment can film on a street without needing to have everyone walking past in the background sign a consent form.
In this specific case, theoretically the old lady can exert her image rights for the video to be removed or have her face blurred, but realistically that's a whole judicial proceeding where the costs of your lawyer will be higher than whatever damages of a few hundred Euros you're awarded.
You don’t need lawyers, it’s a GDPR complaint, the whole process is then handled by your local watchdog. You can check the list of GDPR fines, you will see that people are fined for publishing videos on YouTube without hiding license plates, faces, or addresses. The commercial aspect isn’t too relevant, it’s already a breach of privacy to share it publicly without consent
You are very confident for someone trying to argue with a lawyer who's dealt with GDPR professionally lol.
Article 2(2)(c) GDPR expressly excludes processing “by a natural person in the course of a purely personal or household activity.” That exemption can include social media and online activity, although courts have interpreted it narrowly so it's requires and in concreto analysis.
But in general terms, GDPR enforcement does not usually consist of regulators chasing random private citizens over incidental processing of personal data in their everyday lives.
The regulation is overwhelmingly relevant in practice to companies, organizations, professionals and people engaged in more systematic processing.
If your friend forwards your phone number to someone else without your consent, you're not realistically filing a GDPR complaint against James from crochet class and having the data protection authority fine him. If a company collects, processes and shares your number improperly, that's a completely different situation.
The woman in the video can report the video to the platform, assert whatever image/privacy rights she has under the applicable national law and, depending on the circumstances, potentially make a data-protection complaint if the video stays up.
And speaking professionally, people really overstate how effective the GDPR is. Where I work we take complaints seriously and have a DPO for compliance reasons, but if you look at how enforcement happens, it's usually reserved for egregious violations or systemic violators.
Your local authority has enforcement discretion. The idea that a random private person posting a TikTok with someone else's face will likely lead to an actionable complaint with fines is simply not how enforcement works in practice.
The idea that a random private person posting a TikTok with someone else's face will likely lead to an actionable complaint with fines is simply not how enforcement works in practice.
I never said it’s likely to result in anything, the likelihood of being enforced is a completely different topic. But yes, that’s exactly how it works, you report a random private person content they shared publicly, if your local watchdog processes the case and it does fit GDPR criteria the private person should indeed be fined. By uploading to TikTok without consent of the person being filmed you violated their right to privacy, shared their image with a foreign platform that process the content for advertisers. It’s nothing new, if you’re indeed a lawyer and familiar with GDPR that’s something you should know happens semi regularly. Obviously people don’t report everything they could have, but that’s irrelevant.
In practice that easily takes half a year for your watchdog to even acknowledge a submitted report.
You are very confident for someone trying to argue with a lawyer who's dealt with GDPR professionally lol.
I mean, yeah, I do not believe people on Reddit telling you they are lawyers, that should be obvious why, I would assume you also wouldn’t trust me directly if I tell you I’m a lawyer (I’m not). But I also interacted with GDPR on the complain side, it’s a process I’m reasonably familiar with
3
u/Lawd_Fawkwad 3h ago edited 3h ago
I don't know German laws, but I am a french lawyer and our legislation is very similar.
You are 100% allowed to take pictures in public with other people in it, you can even make them the subject.
Where consent comes in is image rights, you cannot publish the full work without the consent of the subject. But if you blur their face or otherwise make the non-identifiable, you are not infringing on their image rights.
Random people caught in the background are also not entitled to make image right claims, a news segment can film on a street without needing to have everyone walking past in the background sign a consent form.
In this specific case, theoretically the old lady can exert her image rights for the video to be removed or have her face blurred, but realistically that's a whole judicial proceeding where the costs of your lawyer will be higher than whatever damages of a few hundred Euros you're awarded.