privacy gdpr european-union
Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?
<p>Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them. </p>

<p>Many of my friends have their personal assistance in their phones that is constantly hearing what happens in the vicinity of the phone. Sometimes, since they are my friends, these apps record my voice and process it.</p>

<p>I never consented to these companies to process and store my data, only my friends allowed it. However there is little doubt that these companies also have all these information about me, my facial expression, my voice signature, and many other personal information.</p>

<p>I have two questions:
Is this permissible under EU private data law?
Can I sue these companies for illegally storing so much information about me?</p>

<p>How can I prevent that such companies have so much information about me?</p>

<p>Per GDPR Art 79, you can sue data controllers if you consider your rights to have been violated. Where you have suffered damages due to GDPR infringements, you also have a right to compensation per Art 82.</p>

<p>However, your rights may not have been violate as far as the GDPR is concerned. Under the GDPR any kind of personal data processing needs a clear purpose, and that purpose needs a legal basis. One possible legal basis is consent, but there also are others (such as <em>legitimate interest</em>). Just because you didn't consent doesn't mean that your rights have been violated.</p>

<p>Where processing is based on legitimate interest, you can object to that processing of your personal data – but your rights must be balanced against that legitimate interest (Art 21). If your friends post a photo and you only appear in the background, your friends' legitimate interest to post that photo likely outweighs your rights.</p>

<p>In practice, suing Facebook because of GDPR infringement is not a sensible way to achieve the outcomes that you likely want. First, this is expensive. Second, it is arguable whether Facebook or your friends should be the defendant. Third, removal of existing data won't prevent the processing of new data in the future. It would be more sensible to treat this as an interpersonal rather than a legal problem, and to talk with your friends so that they don't include you in their photos that they would like to share online.</p>

<p>I've focussed on photos because their situation is fairly clear. Voice snippets might not count as personal data when you are not identifiable in them. Personal assistant apps should not be listening continuously, but only start recording when a wake-word is recognized.</p>
