"I think the ruling will surprise a lot of people who probably don't think too much before they tweet or post photos," said Neil Brown, a technology lawyer at Decoded Legal.
A woman has been ordered by a court in the Netherlands to delete photographs of her grandchildren that she posted on social media outlets Facebook and Pinterest without their parents’ permission.
The issue came to court as the woman and her daughter disagreed about posting the children’s pictures on Facebook and Pinterest.
An expert told BBC News the ruling reflected the “position that the European Court has taken over many years”.
The mother of the children in the Netherlands had asked their grandmother to delete the photographs of her grandchildren several times without success.
The GDPR does not apply to the “purely personal” or “household” processing of data. However, that exemption did not apply because posting photographs on social media made them available to a wider audience, the ruling stated.
“With Facebook, it cannot be ruled out that placed photos may be distributed and may end up in the hands of third parties,” it said.
The woman must remove the photos on Facebook and Pinterest or pay a fine of €50 for every day that she fails to comply with the order, up to a maximum fine of €1,000.
“I think the ruling will surprise a lot of people who probably don’t think too much before they tweet or post photos,” said Neil Brown, a technology lawyer at Decoded Legal.
“Irrespective of the legal position, would it be reasonable for the people who’ve posted those photos to think, ‘Well, he or she doesn’t want them out there anymore’?”
“Actually, the reasonable thing – the human thing to do – is to go and take them down.”
The European Union’s General Data Protection Regulation (GDPR) is a new data protection law that entered into force on 25 May 2018.
It aims to strengthen and unify data protection for all individuals within the European Union and cracking down on how companies like Google and Facebook use and sell the data they collect on their users.
The law marked the biggest overhaul of personal data privacy rules since the birth of the internet.