0

(Global question: EU, US, etc)

I'm recording a video for YouTube where I show how browser extension works while surfing through different Facebook Groups, Business Pages, Personal Profiles, etc.

Should I blur surnames and photos of people who meet on the screen?

According to this article: https://gdpr.eu/eu-gdpr-personal-data/ photos are also considered personally identifiable information:

Video, audio, numerical, graphical, and photographic data can all contain personal data. ... Methods of identification that are not present today could be developed in the future, which means that data stored for long durations must be continuously reviewed to make sure it cannot be combined with new technology that would allow for indirect identification.

So it's possible to find people if I show their avatars (using Neural Networks, Google Images, or other services). So It seems that even avatars should be blurred.

But should I blur personally identifiable information? Especially considering that people on Facebook made it public and do not hide it.

Thanks!

1
  • Besides the legal issues there is a technical problem with your proposal: blurring and pixelation are often not enough to reliably hide the data (tool for recovering pixelated text). Always use fully opaque black bars (and not as a separate layer). Apr 5 at 18:11
3

There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea.

At least under GDPR, “but they made it public” is not an excuse. Personal data is personal data regardless of how you acquire it. The GDPR also has a very broad concept of identifiability that goes beyond direct identifiers or PII. If you want to use other people's personal data, you need a legal basis, and must provide them notice about your processing. Consent (informed opt-in) is one legal basis, legitimate interest (opt-out) another. You are suggesting to avoid this by blurring PII, but you may also have to blur other content that is indirectly identifiable. Real anonymization that meets the GDPR's definition is a really hard problem.

In some cases, a legitimate interest is able to avoid such problems. E.g. if I make a video with commentary about a Tweet, it would likely be OK to show surrounding personal data like the responses including the identities of the various accounts, to the degree that this is relevant to the commentary and/or necessary for proper attribution. However, that commentary likely has strong protections under freedom of expression. At least from an European viewpoint, a tutorial, demo, or advertisement would not have a freedom of expression argument that would shift a GDPR legitimate interest balancing test in your favour.

Instead of blurring almost everything in your video or working on GDPR compliance, content licenses, and release forms, you should consider a different solution: create dummy content just for your videos. You can use your own content, and maybe add a dummy profile.

6
  • Thank you for the great answer! > content licenses, copyright, data protection, and release forms — could you please tell more about it? Not only about PII. Thanks!
    – dortonway
    Mar 20 at 22:50
  • > you should consider a different solution: create dummy content just for your videos. — do you mean to create Facebook Groups, profiles, etc and record them or do you mean create HTML & CSS markup (create kind of simple version of Facebook) to record video? Thanks!
    – dortonway
    Mar 20 at 22:56
  • @dortonway Re dummy content: for promotional videos it might be best to create Photoshop mockups and animate them, for technical demos I'd create a separate account. But this depends on what your extension would be doing. I wouldn't recreate FB in HTML. Re copyright: other people's posts and images are protected by their copyright. You can't use them without a license, or at least a suitable copyright exception (e.g. fair use in the US). FB has received a license to show posts publicly through their terms, but this doesn't give you any rights.
    – amon
    Mar 21 at 12:59
  • what license has FB received?
    – dortonway
    Mar 22 at 6:56
  • 1
    @dortonway When you post something on Facebook or here on Stack Exchange, you give the company a license (the right) to make copies and to publicly show the posted material. Here on SE, you also give everyone else a license (CC-BY-SA 4.0). Not so on FB. So when you see other people's posts on FB, you have no right/license to copy them – or to include them into your video.
    – amon
    Mar 22 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.