1

Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist, but in any case he attends many political protests, films much footage at them, and posts a lot of stuff on his online blog as well as on various other platforms, but does not draw an income from these activities.

One day he is encountered by Bob at a protest, but they are political adversaries, not allies. Cameron films Bob during the protest, and Bob, assuming that he is a data controller, solicits Cameron’s contact details for the purposes of exercising his data protection rights. Cameron responds by asking Bob whether he is on crack or what he is otherwise smoking, as he has never contemplated matters like data protection legislation before, nor ever had to.

What is the situation here legally, and what is it practically? How can Bob go about seeking recourse and a means to reach Cameron, or to serve correspondence on him, or to more rigorously ascertain whether or not he is in fact a data controller?

TylerDurden
  • 11,476
  • 3
  • 33
  • 105

1 Answers1

5

Probably

The Material Scope of the GDPR is spelled out in Article 2.

The videos that Cameron takes of natural persons are unequivocally personal data and his use of them counts as processing.

Of the exemptions in sub-clause 2, only 2(2)(c) might be applicable: “by a natural person in the course of a purely personal or household activity”. However, Cameron’s political/journalistic activities are not “a purely personal or household” activities - they are public and externally directed.

Cameron is almost certainly a data controller under the GDPR.

Cameron’s response indicates that he is ignorant of this and of his responsibilities. Bob can make a complaint to the regulator with as much detail as he can to allow them to pursue Cameron.

Dale M
  • 237,717
  • 18
  • 273
  • 546