Can you be a data controller without running a business if you take photos and share them on social media?

ANSWER

According to Recital 18 of the GDPR preamble, the Regulation does not apply to processing of personal data by a natural person in the course of a purely personal or household activity, i.e. without any connection to a professional or commercial activity.

This means that a natural person may also be a data controller, i.e. decide on the purposes and means of processing personal data, if they do so for gainful or commercial purposes.

It is not necessarily required that a natural person run a sole proprietorship in order to be a data controller.

If, therefore, in the situation described photos are taken as part of additional work — there is a professional purpose or the person receives remuneration — they will be regarded as a data controller under Article 4(7) GDPR.

When posting photos of children on social media, i.e. disseminating their image, it is necessary to remember to have an appropriate legal basis for processing children's personal data (e.g. Article 6(1)(a) or Article 6(1)(f) GDPR), as well as consent to dissemination of the image under Article 81(1) of the Polish Copyright and Related Rights Act.

It is also necessary to fulfil the information obligation under Article 13 GDPR.