gdpr european-union
Understanding the last sentence in Article 25(2) of GDPR
<p>Article 25(2) of GDPR says the following (emphasis mine):</p>
<blockquote>
<p>The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the <strong>individual's intervention to an indefinite number of natural persons</strong>.</p>
</blockquote>
<p>I understand everything up to the section highlighted in bold. Who is the &quot;individual&quot; in &quot;individual's intervention&quot;? The user of the controller's website?</p>
<p>If yes, does this basically say that an individual user, whose data is stored by a controller, has the right to &quot;intervene&quot; and ask for his/her data to be deleted?</p>
<p>If yes, why does it say an &quot;indefinite number of natural persons&quot;?</p>
<p>I thought that you can only ask for your own personal data to be erased, not somebody else's.</p>

<p>Indeed, this is not drafted very well. But from context, it seems that the “individual” unambiguously refers to the <em>data subject</em>.</p>
<p>What this section says is that data controllers such as websites should provide privacy-friendly default settings. In particular, the user's data should not be public by default. The user may be free to change that, but it should be the user/data subject/individual's decision to enable public visibility. Of course, this is only required where “appropriate”, so this also depends on the context of the data controller's processing activities.</p>
<p>For example, consider a social network where users can add information to their profile at different visibility levels like “only visible to me”, “visible to friends”, or “visible to everyone”. Under Art 25(2) GDPR the default setting should be “only me” or “friends” but not “everyone”, though the user is allowed to change this.</p>
<p>As another example, consider a pastebin-style site where users can post text snippets in order to share them via a link. Under Art 25(2) the site should not make the snippets accessible to anyone, for example by identifying snippets by sequential ID numbers or by instructing search engines to crawl the snippet, unless the user has given consent.</p>
<p>The term “indefinite number of natural persons” instead of “the public” might help avoid misunderstandings for example in cases where an online platform is not open to the public (e.g. account registration is required), but the data subject still doesn't know who specifically would have access to their data.</p>
