Is sharing photos of a third party on a social media platform a breach of the GDPR?

ANSWER

Under Recital 18 of the GDPR preamble, the provisions of the Regulation do not apply to a natural person in the course of a purely personal or household activity, i.e. without any connection to a professional or commercial activity. Personal or household activity may include, among other things, correspondence and keeping address books, maintaining social contacts, and online activity undertaken in the course of such activity.

Applying the above to the question asked, a person who shared a photo of a third party in the course of their professional or commercial activity may be regarded as a data controller. If a personal data breach is found to have occurred, the person whose photo was shared without a legal basis may either lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office, under Article 77(1) GDPR, or claim compensation under Article 82(1) GDPR if, as a result of a breach of the Regulation, they suffered material or non-material damage.

However, if the person sharing the photo on the social media platform acted for personal purposes and cannot be regarded as a data controller, the right to pursue the matter in court will apply — for protection of personality rights under Articles 23 and 24 of the Civil Code.