gdpr youtube personal-information
Should I blur personally identifiable information on Facebook screen recording for YouTube?
<p>(Global question: EU, US, etc)</p>
<p>I'm recording a video for YouTube where I show how browser extension works while surfing through different Facebook Groups, Business Pages, Personal Profiles, etc.</p>
<p>Should I blur surnames and photos of people who meet on the screen?</p>
<p>According to this article: <a href="https://gdpr.eu/eu-gdpr-personal-data/" rel="nofollow noreferrer">https://gdpr.eu/eu-gdpr-personal-data/</a> photos are also considered personally identifiable information:</p>
<blockquote>
<p>Video, audio, numerical, graphical, and photographic data can all contain personal data.
...
Methods of identification that are not present today could be developed in the future, which means that data stored for long durations must be continuously reviewed to make sure it cannot be combined with new technology that would allow for indirect identification.</p>
</blockquote>
<p>So it's possible to find people if I show their avatars (using Neural Networks, Google Images, or other services). So It seems that even avatars should be blurred.</p>
<p>But should I blur personally identifiable information? Especially considering that people on Facebook made it public and do not hide it.</p>
<p>Thanks!</p>

<p>There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea.</p>
<p>At least under GDPR, “but they made it public” is not an excuse. Personal data is personal data regardless of how you acquire it. The GDPR also has a very broad concept of identifiability that goes beyond direct identifiers or PII. If you want to use other people's personal data, you need a legal basis, and must provide them notice about your processing. Consent (informed opt-in) is one legal basis, legitimate interest (opt-out) another. You are suggesting to avoid this by blurring PII, but you may also have to blur other content that is indirectly identifiable. Real anonymization that meets the GDPR's definition is a <em>really hard</em> problem.</p>
<p>In some cases, a legitimate interest is able to avoid such problems. E.g. if I make a video with commentary about a Tweet, it would likely be OK to show surrounding personal data like the responses including the identities of the various accounts, to the degree that this is relevant to the commentary and/or necessary for proper attribution. However, that commentary likely has strong protections under freedom of expression. At least from an European viewpoint, a tutorial, demo, or advertisement would not have a freedom of expression argument that would shift a GDPR legitimate interest balancing test in your favour.</p>
<p>Instead of blurring almost everything in your video or working on GDPR compliance, content licenses, and release forms, you should consider a different solution: create dummy content just for your videos. You can use your own content, and maybe add a dummy profile.</p>
