u/HopeZestyclose3128

Scenario: Andrey, a small business owner operating a shop within a gated community, was repeatedly disturbed by children aged 8–10 playing noisily near his shop, violating the community's noise curfew after 8 PM. Unable to reach the building authority directly, Andrey recorded a short video of the children and emailed it to the building management as evidence. A parent subsequently issued a legal notice claiming violation of the child's privacy under GDPR. Legal

Issues: 1. Did Andrey have a lawful basis under Article 6 GDPR to record and share the footage?

2. Does the involvement of children aged 8–10 trigger additional protections under Article 8 GDPR?

3. If the footage captures identifiable facial features, does Article 9 GDPR apply as biometric data?

Analysis: On lawful basis, Andrey may attempt to rely on legitimate interests under Article 6(1)(f) GDPR. However, a balancing test must weigh his business interest against the fundamental privacy rights of children, who receive heightened protection under GDPR. Children cannot be expected to anticipate surveillance, making this balance difficult to satisfy.

On children's data, Article 8 GDPR imposes stricter obligations where data subjects are minors. Processing personal data of children requires particular justification, and the absence of parental consent significantly weakens Andrey's legal position. On biometric data, if the video enables identification of the children through facial recognition, it qualifies as biometric data under Article 9(1) GDPR — a special category requiring explicit consent or a specific Article 9(2) exception, none of which appear applicable here.

Conclusion: Andrey's recording and sharing of the video likely constitutes unlawful processing under GDPR. A privacy-compliant alternative would have been a written complaint to building authorities describing the incident without capturing identifiable images of minors.

Tags: legal, GDPR privacy, AI training, Data protection