(Global question: EU, US, etc)
I'm recording a video for YouTube where I show how browser extension works while surfing through different Facebook Groups, Business Pages, Personal Profiles, etc.
Should I blur surnames and photos of people who meet on the screen?
According to this article: https://gdpr.eu/eu-gdpr-personal-data/ photos are also considered personally identifiable information:
Video, audio, numerical, graphical, and photographic data can all contain personal data. ... Methods of identification that are not present today could be developed in the future, which means that data stored for long durations must be continuously reviewed to make sure it cannot be combined with new technology that would allow for indirect identification.
So it's possible to find people if I show their avatars (using Neural Networks, Google Images, or other services). So It seems that even avatars should be blurred.
But should I blur personally identifiable information? Especially considering that people on Facebook made it public and do not hide it.