A Dutch court has interpreted the General Data Protection Regulation to cover a woman's posting of photos of her grandchildren on Facebook. That means, in this case, she has to take the photos down, the BBC reports, because she lacks the parents' permission to post them. After a rift between the two, the daughter asked several times that her mother take the photos down, then took the matter to court. The grandmother will face fines if she doesn't delete the photos or posts others of the children. The EU regulation has an exemption for "purely personal" uses, but the court said posting the photos on social media makes them broadly accessible. "With Facebook, it cannot be ruled out that placed photos may be distributed and may end up in the hands of third parties," the ruling said.
"I think the ruling will surprise a lot of people who probably don't think too much before they tweet or post photos," said Neil Brown, a tech lawyer. While acknowledging the added concern when such issues involve children, Mike Masnick writes in Techdirt that the case illustrates that the GDPR might be used for censorship. The measure turns 2 years old next week. In marking the anniversary, the EU said the regulation "ensures that citizens have more control over their personal data" but acknowledged that "compliance is a dynamic process and does not happen overnight." Regardless of the legal requirements, Brown suggests what to do when in doubt about whether the subjects want photos of them posted on social media. "The reasonable thing—the human thing to do—is to go and take them down," he said. (The GDPR changed things when it took effect in 2018.)