After appearing in a photo posted by a friend on a social network, a person felt embarrassed and decided that he wants the photo to be deleted. According to the General Data Protection Regulation (GDPR), does that person have the right to delete this photo?

A photograph in which a person is identifiable constitutes personal data under Article 4(1) of the General Data Protection Regulation (GDPR). The GDPR grants data subjects several rights over their personal data, including the "right to erasure" (also known as the "right to be forgotten") under Article 17. In this scenario, the person (the data subject) can invoke their right to erasure. The legal grounds for this request are strong, particularly under: Article 17(1)(c): The data subject objects to the processing, and there are no overriding legitimate grounds for the processing. The friend's interest in sharing the photo is unlikely to override the data subject's right to privacy and protection from embarrassment. Article 17(1)(d): The personal data have been unlawfully processed. If the friend posted the photo without a valid legal basis under Article 6 (such as the data subject's explicit consent), the processing is unlawful from the outset. The data controller(s) in this case—the friend who posted the photo and the social network platform—are obligated to delete the data upon a valid request, unless specific exceptions apply (e.g., for exercising the right of freedom of expression), which is highly unlikely in this context.

The alternative, "False," is incorrect because it negates a fundamental right provided by the GDPR. The regulation is specifically designed to give individuals control over their personal data, and the right to erasure is a key component of this control, especially in online environments like social networks.

1. Official Journal of the European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), L 119/1, 27 April 2016.

Article 4(1): Defines 'personal data' as "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person." A photograph clearly falls under this definition.

Article 17(1): "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay...". It lists the grounds, including "(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing..." and "(d) the personal data have been unlawfully processed."

2. Ausloos, J. (2020). The Right to Erasure: Safeguard for Informational Self-Determination in a Digital Society? KU Leuven Centre for IT & IP Law. (Doctoral Dissertation).

Chapter 5, Section 3.2.2, pp. 257-258: Discusses the application of the right to erasure to user-generated content on social networking sites. The text explains that when a user posts content about another individual (e.g., a photo), that individual, as a data subject, can exercise their rights, including the right to erasure, against the user who posted it and the platform provider, who are both considered data controllers. The lack of a valid legal basis for the initial posting strengthens the claim for erasure.

3. European Data Protection Board (EDPB). (2020). Guidelines 07/2020 on the concepts of controller and processor in the GDPR. Version 2.1, 7 July 2021.

Paragraph 33: "A user of a social network who uploads photos of other individuals should be considered as a controller... for the processing of the personal data of the other individuals." This establishes the friend's role as a data controller against whom the right to erasure can be exercised.