I don't think that GDPR applies here.
There are three actors: Alice, Bob, and the Platform. Bob published Alice's personal data through the Platform. Then, we have to consider who of them would be the data controller for this processing activity. Only the controller would be responsible under GDPR for compliance and for handling data subject requests.
I will take it as a given that the scenario involves the processing of Alice's personal data.
I also want to highlight the detail that neither Alice nor Bob are in a country where GDPR applies.
Clearly, the Platform is the data controller for most aspects of their service. However:
- Controller is whoever determines the purposes and means of processing (Art 4(7)).
- The GDPR does not apply to processing by a natural person in the course of a purely personal or household activity (Art 2(2)(c)), which includes “social networking and online activity undertaken within the context of such activities” (Recital 18).
- The GDPR would only apply to processing activities that occur in the context of an European establishment of the controller, or when those activities are related to the offering of goods or services to people who are in Europe.
This leads me to the following conclusions:
Only Bob is the data controller for message contents.
When Bob posts a message, the Platform does not exert control over the message contents. The Platform is controller for how they process Bob's and Alice's messages, but it does not control the purposes and means for processing conducted via such messages.
Bob used the Platform for the processing activity of publishing Alice's personal data, and is the controller of that activity.
Alice cannot rely on GDPR against Bob due to issues of territorial scope.
In a nutshell, Art 3 GDPR says that GDPR can only apply if one end of the subject–controller relationship is in Europe. Since the Platform is EU-based, both Alice and Bob are protected by GDPR with respect to the platform's processing activity.
However, this is irrelevant when considering the Alice–Bob relationship. Bob does not have an European establishment, so is not subject to GDPR per Art 3(1). Bob does not offer goods or services to people who are in Europe, so is not subject to GDPR per Art 3(2).
Even if Bob were to offer goods or service to people in Europe, Alice wouldn't be covered by GDPR because Bob's processing of Alice's data wouldn't be “related” to such offering, unless perhaps this Platform is some kind of marketplace.
Bob might have to comply if he was EU-based.
If Bob was EU-based, things would be more interesting. Now, Bob would clearly be in the GDPR's Art 3 territorial scope, but we must also consider the Art 2 material scope.
If Bob is an individual and not a company, Bob might invoke the household exception that exempts normal social media use. However, taking into account CJEU case law from Rynes and Lindqvist, making the data public is unlikely to fall under this narrow exemption.
So in this alternative scenario, Bob might be in scope of the GDPR as a data controller, and would then have to comply with its requirements.
Even if GDPR were to apply, deletion may not be required.
“Only a Sith deals in absolutes”, and the GDPR is very much not a Sith. It is based around foundational principles in Art 5, and these must be carefully balanced with other rights.
Bob might have an Art 6(1)(f) legitimate interest in publishing a “name and shame” post. This would depend on the specific context, though.
Bob might be covered by an Art 85 GDPR exception for freedom of expression and information, in particular if the data was published for journalistic purposes. However, such exemptions must be provided by member states.
Bob might not have to fulfil an Art 17 erasure request if none of the deletion criteria are met, in particular if Bob's legitimate interest in publication would override Alice's objection, or if publication is necessary for exercising the right of freedom of expression and information.
These carve-outs for freedom of expression are important, e.g. to prevent a public figure from abusing GDPR to silence public criticism.
The Platform might have an obligation to provide safety features.
As discussed above, I don't think that the Platform is a controller regarding Bob's publication.
However, data controllers have general obligations to ensure the compliance and security of their own processing, which requires the adoption of appropriate technical and organizational measures. In particular, the Platform must ensure data protection by design and by default (Art 25).
Perhaps this could be interpreted to require safety features on the Platform, such as content visibility settings and moderation flags. However, it is not reasonable to interpret this in a way that would force the Platform to censor or delete otherwise-legal content.
GDPR is the wrong mechanism here.
GDPR is a fairly high-profile law, and is sometimes used in ways that it wasn't designed for. For example, the right to access is sometimes used as a kind of Freedom of Information device, and misunderstandings about the GDPR's territorial scope often see international data controllers being wrongly threatened with it.
This scenario is different in that it could be legitimately viewed as a data protection issue between Alice and Bob, if that relationship were subject to GDPR.
But it is not appropriate to use the GDPR against the Platform here, since the Platform is not the data controller for the processing activity in question. Instead, Alice would have to find some other reason why the Platform would be liable in some way. For example, if Bob's message were to constitute some kind of illegal doxxing, and Swedish rules were to hold platforms liable when they are informed of illegal user content, then Alice would likely be able to get Bob's content taken down.
Alice could also consider whether some other rights were violated by Bob's message. For example, if Bob's message was defamatory, violated personality rights, or breached some duty to confidentiality of communications, then Alice might be able to get Bob to take the content down. But this would depend primarily on the laws in Bob's location.
Someone mentioned the issue of copyright. Mere data such as a name is not covered by copyright. However, if Bob published material written by Alice, and this publication is not covered by a copyright exception, then it might be possible to get Bob's post taken down. There is a small hiccup here that Alice might have already given the Platform the necessary rights to publish her writing via the Platform terms of service.
