Is posting another persons PI on social media a GDPR violation?
<p>If Alice posts Bobinators private information like full name and address on a Facebook group, in an attempt to warn others of bad experience with him, is it a GDPR violation?</p>
<p>Does it matter if a group is private or public? Or if it's in a comment or her own wall? Does it matter if Bob really did do the bad thing?</p>
<p>If it's a violation who should Bob ask for the fix before complaining to his local data protection agency? Alice, Facebook, group admins, or someone else entirely?</p>
<p>My research of the topic didn't go well because I'm getting just a huge amount of information about how to remove your private data from Facebook, and how to stop companies from sharing it, it's very hard to get information about private people making public posts.</p>

<p>Perhaps. But invoking the GDPR might not be that useful here.</p>
<p>The GDPR does not apply to processing of personal data for purely personal or household purposes. Ordinary social media use is covered by this exception. Warning friends about another person is fine.</p>
<p>Publishing personal data to an indeterminate number of recipients is probably not covered by this exception.
Such publication would require a legal basis under the GDPR.
For example, such publication <em>might</em> be necessary for a “legitimate interest”.
But that would require a case-by-case analysis that also weighs this interest against the rights and interests of the affected person.
For this balancing test, I'd think that it would be quite important whether Bob did the Bad Thing: if Bob didn't do the Bad Thing, then there can't be a legitimate interest in publishing the personal data to warn others.</p>
<p>If there is a legitimate interest, then only activities that are necessary for that legitimate interest are covered. If publication of a name is sufficient, also publishing the address would be illegal.</p>
<p>When exercising data subject rights such as the right to object to legitimate interests or the right to erasure, the request must be made to the data controller who is responsible for the data processing activities.
Here, Alice is clearly a data controller because she decided to disseminate the information.
But Facebook or the group admins would likely be joint controllers, and would also be responsible.
Note that an objection to further processing can be denied if there are overriding legitimate grounds.</p>
<hr />
<p>If Bob wants to take down Alice's postings, GDPR data subject rights are probably not the most suitable mechanism. Instead:</p>
<ul>
<li><p>Depending on which country this is happening in, there are probably laws against defamation. Depending on those laws and on what Alice claimed, the posts might be defamatory, even if the alleged behavior by Bob is true. Bob's lawyer could write Alice a cease and desist letter asking for the allegedly defamatory post to be taken down, or sue if Alice doesn't comply.</p>
</li>
<li><p>Since the posts have been made on Facebook, FB's policies apply. In particular, certain content might violate the <a href="https://transparency.fb.com/policies/community-standards/bullying-harassment/" rel="nofollow noreferrer">community standards against bullying or harassment</a>. Posting someone's address is clearly against the <a href="https://transparency.fb.com/policies/community-standards/privacy-violations-image-privacy-rights/" rel="nofollow noreferrer">Facebook community standards about privacy violations</a>. The FB help center explains <a href="https://www.facebook.com/help/181495968648557/" rel="nofollow noreferrer">how to report things</a>.</p>
</li>
</ul>

gdpr