GDPR Rules for Filming in Public: What You Need to Know Before You Publish

Filming or photographing in public feels like a simple act of documentation. Under GDPR, it almost always constitutes personal data processing — the moment an individual is identifiable in your footage, the Regulation applies. This guide explains exactly when GDPR is triggered, which exemptions are genuine, and why anonymization is the most reliable path to compliance before you publish.

Legal disclaimer: This guide is for informational purposes only and does not constitute legal advice. GDPR interpretation varies across EU member states and is subject to national-law derogations. Always consult a qualified legal professional before making compliance decisions for your organization.

TL;DR

• GDPR applies to public footage: any image or video in which an individual is identifiable is personal data under Article 4(1) — location does not change this.
• Exemptions are narrow: the household exemption (Article 2(2)(c)) covers purely personal use; journalistic, research and artistic uses depend on national-law derogations under Article 85.
• Legitimate interests can apply, but require a documented balancing test; consent is impractical at scale in public spaces.
• Anonymize before publishing: irreversible removal of identifiable faces and licence plates eliminates GDPR scope under Recital 26 — the cleanest compliance outcome. Blur faces in your video automatically →

When Does GDPR Apply to Public Filming?

The starting point: Article 4(1) and identifiability

GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4(1)). An individual is identifiable if they can be singled out "directly or indirectly" — including by reference to physical appearance. A video frame containing a recognisable face, or a photograph in which someone's gait and clothing make them re-identifiable in context, meets this definition even without a name attached.

The fact that filming takes place in a publicly accessible space does not exempt the recording from GDPR. It may affect the proportionality analysis under a legitimate-interests basis, but it does not remove the legal basis requirement.

What constitutes personal data in footage?

Data element	Personal data?	Notes
Identifiable face	Yes	Even without a name; Article 4(1)
Licence plate	Yes	Linked to registered keeper; indirectly identifies individuals
Voice recording	Generally yes	If attributable to an identifiable speaker
Crowd of indistinguishable individuals	No	Where no individual can be singled out
Fully anonymized footage	No	Recital 26: anonymous information falls outside GDPR

The household exemption — narrower than you think

Article 2(2)(c) excludes processing "in the course of a purely personal or household activity." The Court of Justice of the EU clarified in Ryneš v. Úřad pro ochranu osobních údajů (Case C-212/13) that this exemption requires the activity to remain entirely within the private sphere. A home security camera trained on a public pavement, street, or shared space falls outside the exemption because it captures data about individuals who have no relationship with the household.

In practice, the household exemption covers:

• Holiday photos kept within a family group
• Home videos shared only with close friends

It does not cover:

• Any footage published online, even on a personal account
• CCTV covering areas outside the immediate private property boundary
• Content shared with third parties for any purpose

Legal Bases for Filming in Public Spaces

Where the household exemption does not apply, you must identify a valid legal basis under Article 6(1). The most commonly relevant are:

Legitimate interests (Article 6(1)(f))

Legitimate interests is the legal basis most often invoked for street photography, documentary footage and security monitoring. It requires a three-part analysis:

1. Purpose test — a genuine, real interest exists (news coverage, security, artistic expression)
2. Necessity test — the recording is necessary to achieve that interest; less intrusive means would not suffice
3. Balancing test — the controller's interest overrides the data subjects' rights and freedoms, taking into account their reasonable expectations in the context

Filming a political rally, a sporting event, or a public ceremony can generally satisfy this test because participants have a reduced expectation of privacy in that context. Secretly filming individuals in a cafe or a hospital waiting room almost certainly cannot, regardless of the public accessibility of the space.

Consent (Article 7)

Consent must be freely given, specific, informed and unambiguous. In public filming scenarios, obtaining prior consent from every identifiable individual is generally impractical. Where consent is the intended basis, you must be able to demonstrate it was obtained and allow withdrawal at any time — obligations that are difficult to meet retrospectively for footage already recorded.

Journalistic, academic and artistic exemptions (Article 85)

Article 85 requires member states to provide exemptions or derogations for processing "for journalistic purposes and the purposes of academic, artistic or literary expression." These derogations vary significantly by country. In Germany, press law creates broad protections; in France, the CNIL has published guidance carving out professional journalism. These exemptions are national in scope, narrowly construed, and typically require that the processing is genuinely in the public interest and that the data subject's rights be infringed only to the extent necessary.

Do not assume Article 85 applies automatically. Verify the relevant national implementation before relying on it.

Special-Category Data in Public Footage

Article 9 GDPR imposes stricter rules on special-category data, including data that reveals:

• Racial or ethnic origin
• Health information
• Religious or philosophical beliefs

Footage recorded in public can inadvertently contain special-category data — for example, footage of a religious procession, a disability pride march, or the exterior of a medical clinic where individuals are identifiable. Processing such footage requires both an Article 6 basis and a specific Article 9(2) ground. The most commonly available grounds for public filming contexts are:

• Article 9(2)(e): data manifestly made public by the data subject (limited application — applies where the individual has themselves publicly declared the characteristic, not merely appeared in public)
• Article 9(2)(g): substantial public interest, with national law authorisation and proportionate safeguards
• Article 9(2)(j): archiving, research or statistical purposes with appropriate safeguards

In practice, if your footage could reveal special-category characteristics of identifiable individuals, anonymization before publication is the most defensible course.

Practical Compliance Checklist for Public Filming

Before recording:

• Identify the legal basis you will rely on (Article 6 + Article 9 if applicable)
• Document the balancing test if relying on legitimate interests
• Check whether a national-law exemption applies (Article 85, sector legislation)
• Assess whether footage will capture children — apply heightened protections

Before publishing or sharing:

• Determine whether all individuals in the footage remain identifiable
• If yes: either obtain valid consent, confirm a robust legal basis, or anonymize
• Apply irreversible anonymization to faces, licence plates and other direct identifiers
• Retain an audit record of what was anonymized, when and by what method
• Confirm the anonymization is irreversible — not merely obscured or pixelated in a reversible way

Why Anonymization Is the Most Reliable Outcome

Every legal-basis analysis involves uncertainty: balancing tests are fact-specific, national derogations differ, and supervisory authority guidance evolves. Anonymization eliminates that uncertainty. Under Recital 26 GDPR, "information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable" falls entirely outside GDPR's scope.

The practical standard is that re-identification must not be "reasonably likely, taking into account all the means reasonably likely to be used" — including AI-assisted analysis of auxiliary data. That means:

• Simple pixelation that can be reversed by super-resolution algorithms generally does not meet the standard
• Deterministic, irreversible deletion of the underlying pixel data — with a retained audit log — generally does

For video content specifically, blurring faces in video using a pipeline that removes rather than masks the source data is the approach most likely to survive regulatory scrutiny. The same principle applies to licence plates, voices, and any other identifiers in the frame.

Street Photography: A Specific Note

Street photography occupies a contested space under GDPR. Many photographers rely on legitimate interests or, where applicable, the artistic expression derogation under Article 85. The key variables are:

Scenario	Likely legal position
Candid crowd photo, individuals not identifiable	Outside GDPR scope
Portrait of identifiable individual, personal exhibition	Article 85 artistic derogation (check national law)
Same portrait published commercially	Requires consent or robust legitimate-interests assessment
Photo posted to social media identifying individual	Article 6 basis required; consider data subject rights
Footage of public event for news outlet	Legitimate interests or journalistic derogation (Article 85)

When in doubt, the practical answer is the same as for broadcast or research footage: anonymize identifiable individuals before the content leaves your control.

Start Protecting Your Footage Before You Publish

GDPR compliance for public filming is not primarily about whether you are allowed to record — in most contexts you are. It is about what you do with the footage before you share it. Identifiable individuals in published video or images are personal data; without a documented legal basis, their appearance in your content is a compliance liability.

Medianonymizer's AI pipeline locates faces, licence plates and other personal identifiers across video, images and audio, then removes them irreversibly with a deterministic process that produces an auditable record of what was changed. No reversible masking, no manual frame-by-frame editing.

Anonymize a file now →