Alice takes photos of people in public and puts them into a portfolio binder for grading by her photography class instructor but does not publish them.

Barbara takes photos on her nights out and publishes them on her personal social photo blog mainly for her friends to like and giggle about.

Charlotte does the same but her photoblog is visible to “friends only.”

Danielle has an open photo blog but she has a buy me a coffee donation link.

Esther does the same but she limits her blog’s access to paying subscribers.

Francesca publishes her photos of current events with political commentary and they include many strangers. Her blog is purely a labour of passion/love.

Gwendolyn has a current events blog like Francesca’s but accepts donations.

Harriet has a similar one but chargesreaders for access, though is it not her full time job.

Which of these is a data controller and which are using the captured photographs purely for household purposes?

  • 2
    It may be necessary to distinguish between making photos and publishing them. The latter is fairly straightforward. One of the important decisions on the household exception was the "Lindqvist" case where someone ran a website that discussed her coworkers. Because it was available to the public / indeterminate number of persons, it was not considered to be purely private. By that standard, all except Charlotte and maybe Alice would be in scope of the GDPR, assuming Charlotte's friends are actually just a couple of friends invited by her.
    – amon
    Jan 6 at 17:20
  • @amon why not post this as an answer? Jan 6 at 18:48
  • I've typed up detailed responses to your scenario over here. I've decided to no longer write answers on Stack Exchange (context), but anyone else is welcome to take my comments and write one. I still sometimes write longer comments on r/gdpr.
    – amon
    Jan 7 at 0:02


You must log in to answer this question.