GDPR Section 2 Recital 18 (?) reads:
Not Applicable to Personal or Household Activities
This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities.
What information do we have to determine what counts as "a purely personal or household activity"?
Data processing tools available to the individual have become much more powerful in recent years, and it seems this is likely to increase rapidly in the near future. Last year I thought the most powerful tools available to anyone that had the potential to break the GDPR were bellingcat's tools for building personal network graphs from public information such as social media and Companies House. However in the last month open source tools derived from Meta’s LLaMA Large Language Model have improved to the point that they are competitive with the best in the world and Google expects them to eclipse this performance in coming months.
For example Vicuna-13B runs on a reasonable gaming computer and when asked "tell me about [FIRST SURNAME] from [INSTITUTION]" will provide a mostly inaccurate paragraph that includes some true personally identifiable information. This works for me and some others who have a web presence such as have published peer reviewed literature but are not in any way famous. They have an online demo that requires no registration, you can try it yourself here.
It seems at the very least it would be challenging to justify the use of such a tool under the GDPR. As I understand it all the information within the network is used to answer every question, even if just as far as "do not use this bit of the network". Therefore any use could be classed as the processing of personal data. Therefore if one wanted to download and experiment with such a model the easiest way would be to rely on the Household Activities exception. However it is not totally clear what would and would not be counted. What information could we use to try and determine if such a use was legal, and what the limits would be?
The ICO has a page on the exceptions but that explicitly does not cover domestic purposes: "This is simply because they are not covered by the UK GDPR". It gives the topic two sentences, the first repeats the law and the second give a couple of examples that are not relevant here.
There is a denied FOI request for "any policy, guidance, lines-to-take or other material you hold on the scope of the exemption contained in GDPR art 2(2)(c) and/ or recital 18" with the denial based on this information appearing in guidance including "a final published version". However I cannot find this guidance with either Google or the ICO website search.
There is a case from the Netherlands that excludes posting photos of one's child on social media from the household use exception. While this may not directly relate to my question, it does illustrate the the exception can be interpreted quite narrowly. It rather surprised me as posting photos of one's children seems to be quite a big bit of social media.