Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist, but in any case he attends many political protests, films much footage at them, and posts a lot of stuff on his online blog as well as on various other platforms, but does not draw an income from these activities.

One day he is encountered by Bob at a protest, but they are political adversaries, not allies. Cameron films Bob during the protest, and Bob, assuming that he is a data controller, solicits Cameron’s contact details for the purposes of exercising his data protection rights. Cameron responds by asking Bob whether he is on crack or what he is otherwise smoking, as he has never contemplated matters like data protection legislation before, nor ever had to.

What is the situation here legally, and what is it practically? How can Bob go about seeking recourse and a means to reach Cameron, or to serve correspondence on him, or to more rigorously ascertain whether or not he is in fact a data controller?

  • I've never heard a photographer refered to as a "data controller" before. (Why not "project manager," or "accountant" for example?) Is there some credible reason for asking this question? And what do their political opinions have to do with it? Jan 5 at 23:13
  • He’s a data controller by processing personal data other than for purely a household purpose. See the GDPR. Jan 5 at 23:26
  • Can you reference a section of the GDPR that specifically categorizes photographs as data? Jan 5 at 23:35
  • 1
    No, but anyway I don’t think it would as such. The definition of personal data presumably from the gdpr that’s normally used is anything from which one can be personally identified in any way. Jan 6 at 0:02
  • 1
    @phoog Given that this is tagged as England & Wales, the relevant text is the UK-amended GDPR, which can be found here: legislation.gov.uk/eur/2016/679/contents Jan 6 at 21:01

1 Answer 1



The Material Scope of the GDPR is spelled out in Article 2.

The videos that Cameron takes of natural persons are unequivocally personal data and his use of them counts as processing.

Of the exemptions in sub-clause 2, only 2(2)(c) might be applicable: “by a natural person in the course of a purely personal or household activity”. However, Cameron’s political/journalistic activities are not “a purely personal or household” activities - they are public and externally directed.

Cameron is almost certainly a data controller under the GDPR.

Cameron’s response indicates that he is ignorant of this and of his responsibilities. Bob can make a complaint to the regulator with as much detail as he can to allow them to pursue Cameron.

  • Does this mean that people in the EU can require that journalists not show or mention them?
    – Someone
    Jan 6 at 1:50
  • 1
    @Someone no, being a data controller doesn’t mean you can’t use the data, quite the opposite
    – Dale M
    Jan 6 at 4:39
  • But what does "pursue Cameron" mean if not taking action in an attempt to prevent publishing of photos of them? Jan 6 at 8:06
  • 2
    @Someone Art 85 GDPR requires that other legislation shall balance GDPR versus journalistic rights, and that there shall be exceptions from the GDPR data subject rights as necessary. So you probably can't use GDPR to force a journalist to divulge sources or to prevent undesired reporting.
    – amon
    Jan 6 at 8:32
  • 3
    @MichaelHall that Bob can pursue Cameron doesn't mean that Bob will prevail. Whether Bob prevails depends on the facts. If there's a legitimate journalistic purpose in publishing the photos with Bob being identified or identifiable then Bob probably won't prevail in having the photos altered or suppressed. But Bob can demand an account of the data being held and a copy of the data, because of the right of transparency.
    – phoog
    Jan 6 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .