I still can't decide whether FB (and others) think they can get away with being non compliant or just accepted violating GDPR is the cost of doing business.
There's zero precedent to suggest that they won't get away with it. All Facebook has to do is go undercover with their data collection and hope that it's never revealed that they're still doing it, or when it does leak, they pay some fine equivalent to half a percent of 3 minutes' profits.
How yould facebook go undercover with their data collection ? every thing they do is provide an infrastructure for data collection.
Give it a couple years and there'll likely be a leak revealing that nothing has significantly affected the main meat of the mega corps' data gathering, someone will say "mistakes were made but we're looking into it", a year later some investigators will say that they can't really do anything because it's technically outside the scope of the law, and it'll vanish until another leak happens the next year.
The EU. Remember, Facebook is an Irish company, headquartered in Dublin.
Where do you draw the line? If the site processes the EXIF metadata are they in violation? If they use a neutral clustering algorithm to group visually similar images, are they in violation (be it humans, cars, or chairs)? if I take a visually clustered group of images and tagthem "a_imho", have I now made the site have biometric data related to you?
I mean, a lot of people say "well, as long as you're in the spirit of the GDPR, don't worry", but lawyers don't care whether you're in the spirit of something, they only care if they can win a case, and when the law is vague, "spirit" seems like one judge could hang you, and another judge could free you depending on the luck of the draw.
This is were you draw the line. Taking pictures of people without their consent (and a good reason) is a big no-no in most parts of the world.
This is either because it's not considered appropriate or because it's condemnable [1] or both. It is also nothing new and not some effect of GDPR, but deeply rooted in culture. Germany, Austria, Switzerland, Italy long had strong laws regarding the right of persons to their own likeness. There is also a big rift, not only legally but primarily culturally, between Anglo-Saxon culture and mostly the rest of the world.
GDPR and other laws concerning informational self-determination[2] never can be interpreted without context. They are always limited by other rights and freedoms, like the right of artistic freedom. So a lot depends on your intent and if you can justify what you do.
I'm not saying this is all well and good. As kind of a street photographer wannabe I'm very sympathetic to the position that the UK and the USA take on this. I'm just saying that the rest of the world has very different ideas about this and this has consequences if you operate globally.
[1] https://commons.wikimedia.org/wiki/Commons:Country_specific_...
[2] https://en.wikipedia.org/wiki/Informational_self-determinati...
I'd personally say taking pictures of people without their consent is a big no-no in some parts of the world, but not all.
I have never personally had any issues with my street photography in the UK, it boils down to being respectful and not behaving in a harassing manor. If there is a reasonable expectation of privacy then one should consider taking an unsolicited photo as an invasion of privacy.
I added the reference to the list as support for my thesis that it can have legal consequences, a fact that in my experience people from the USA or the UK are often oblivious about. Just because it is not forbidden doesn't mean it is acceptable though. I think it is no coincidence that we see strictest regulation in central Europe because these countries are around the border line between the different attitudes. Go farther east and there is no need to regulate the culturally obvious.
> I have never personally had any issues with my street photography in the UK,
Of course not, UK is one of the best countries for shooting street.
> it boils down to being respectful and not behaving in a harassing manor. If there is a reasonable expectation of privacy then one should consider taking an unsolicited photo as an invasion of privacy.
Absolutely.
"Identifying" a purpose could range from simply clustering visually similar photos using any number of non-machine-learning, non-biometrically-aware image processing algorithms, to using DNNs like FaceNet, or using the old eigenvector facial recognition algorithms of the 90s.
As soon as I upload a photo I took of you to a photo hosting system that has any kind of search functionality at all, the risk is raised that you can be categorized and identified somehow. Really, "consent" was broken not by the company, but by the uploader.
I really think the genie's out of the bottle on photos now. So many people are constantly photographing on their phones, and so many are uploading them to publicly accessible feeds all over the internet, that a federated crawler could already be built to track you, in fact, I think there's already some social media monitoring services that offer this.
If you're out in public, you should pretty much assume you have no privacy with regards to your imagery, GDPR isn't gonna save you. You can control your own photos, but you can't control what other people do of photos taken of you.
I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that.
Europe isn't China, and the distribution of those photos isn't an existential threat to the government, so a Great Firewall is overkill.
Facebook has assets, operations, and revenue that originates in Europe that could be easily targeted with little controversy to gain compliance. If that doesn't work, Europle could always try to make the executive decision-makers personally liable. I'm sure Zuckerberg wants to be able to visit Europe in the future without being arrested.
That said, I don't take it as a given that will always be the case. I can imagine future US companies offering services that run sufficiently afoul of current or future regulations in the EU and other jurisdictions that it makes sense to just not offer them there.
I guess the "relax, bro, as long as you're thinking good thoughts you have nothing to worry about" crowd have all recently awoken from 60-year comas.