🤔 Is this allowed?
Doorbell cams, dashcams, recording calls, your boss reading email — quick verdicts with the reasoning.
Yes — if it watches your property, not the streetCamera doorbell at homeFilming your own doorstep is fine. The moment your camera structurally captures the public street or a neighbour’s garden, the GDPR applies to you — with real obligations.No — not at your private spaceNeighbour’s camera on my homeA camera aimed at your garden, windows or door is not covered by any household exemption. You can demand re-aiming, masking, access to footage — and escalate if refused.Often yes for yourself — country rules differ sharplyRecording a callIn many EU countries you may record a conversation you take part in for your own records. Publishing it is a different question everywhere — and some countries restrict even the recording.Usually yes — but rules differ per countryDashcamsDashcams are legal to own everywhere and legal to use in most EU countries — but a few restrict or effectively ban them, and continuous “surveillance-style” recording is the thing regulators punish.Ask first — especially for childrenPosting photos of othersA recognisable photo is personal data. Small private sharing is usually fine; public posting of identifiable people — above all children — needs consent far more often than people think.Only under strict conditionsEmployer monitoringNot just like that. Even at work you keep a reasonable expectation of privacy — monitoring needs a real reason, transparency, and the least intrusive means.Almost never lawfullyFace scanning in shopsBiometric identification of customers is special-category data — near-impossible to base on anything but explicit consent. The AI Act now bans several uses outright.Rarely a full copy — data minimisation rulesCopies of your IDShowing your ID is often required; keeping a full copy rarely is. Data minimisation lets you cross out what they don’t need — and a floating passport copy is identity-fraud gold.Contested — and you can objectAI training on your dataPlatforms lean on “legitimate interest” to feed public posts into AI training. That is legally contested — and Art. 21 gives you an objection right most platforms now honour via a form.Fly yes — film neighbours noCamera dronesEU drone rules let registered hobbyists fly in most places — but the camera turns every flight into data processing, and hovering over gardens collects data you have no right to.Child: within reason · Adult: only with consentTracking family membersLocation-tracking a young child can be justified parental care. Tracking a partner or any adult without their knowledge is unlawful across Europe — and in stalking territory fast.Entrances yes — desks and break rooms barely everCameras at workSecurity cameras on premises can be lawful with notice and a real purpose. Permanent surveillance of workstations, and any camera in changing rooms or toilets, is off-limits everywhere.It records more than you think — you control more than you thinkSmart speakersVoice assistants keep recordings and transcripts tied to your account — including misfires that captured private moments. You can hear, delete and disable most of it; your guests never agreed to any of it.Only with consent — and you can say noSchools & your child’s dataClass photos on the school website or socials need parental consent, per child, refusable and revocable — and saying no may not disadvantage your child. Internal pupil records run on different, stricter rails.At contract stage some — at viewing stage almost nothingLandlords & your documentsScreening dozens of applicants is where rental-market data abuse lives. Before you are the chosen tenant, a landlord needs your contact details and little else.Yes with your sign-up — with real limits and exitsLoyalty-card profilingThe deal is explicit: discounts for data. What many schemes underplay: your rights to see the profile, refuse the marketing, and quit with full deletion — and the hard line at sensitive purchases.Yes with a real decision — never at doors and mailboxesCameras in apartment buildingsCommon-area CCTV is lawful when the owners’ association properly decides it, targets a real problem, and avoids watching who visits whom. One resident’s hobby camera in the stairwell is not that.Hard walls: mostly no · Pay-or-okay: contestedCookie wallsA flat “accept tracking or leave” wall makes consent unfree and is rejected by most regulators. The paid-subscription alternative is the industry’s workaround — under heavy fire for the biggest platforms.Only where a law or YOUR consent opens the doorWho sees my bank dataBank secrecy still exists — with legal doors through it: anti-money-laundering law, tax reporting, and the open-banking access YOU grant apps. Marketing use of your spending is the part you control.Care team yes — everyone else needs your say-so or a lawYour medical recordsHealth data is the most protected category there is. Sharing inside your treatment is normal; sharing with employers, insurers or family needs your explicit consent or a specific legal gate — and you can see your file.Yes — Art. 15 covers camera footageGetting CCTV of yourselfFootage showing you is your personal data: you can request a copy — for an accident claim, a dispute, or just to know. Speed matters, because retention is short by design.Indoors: banned · Outdoors: disclosed onlyCameras in your rentalAirbnb banned ALL indoor cameras in listings in 2024; hotels never lawfully film inside rooms. Undisclosed devices are report-and-refund territory — and often a crime.Limited — job-relevant, transparent, no friend requestsBeing screened before hiringA quick look at your public LinkedIn: tolerated. Systematic trawling of your private life, fake-profile snooping, or silent rejection based on your holiday photos: violations with names.Private groups: rude · Business/mass groups: unlawfulAdded to groups unaskedYour number is personal data, and a group shares it with every member. Friends adding you is social friction; businesses and clubs mass-adding numbers is a GDPR problem — and you can lock it down.Targeted questions yes — your full file, almost neverInsurers & your health dataHealth questions on application and proportionate checks on claims are lawful. Blanket “send us your complete medical record” authorisations are the overreach to strike out.Weeks after rejection — longer only with your consentYour CV after rejectionOnce the process ends, the purpose ends: rejected applicants’ files must go within weeks, not years. “We keep you on file” requires your actual yes.Both directions: yes, within framesPolice & filmingPolice filming runs on specific legal gates, not the GDPR you know — and citizens filming officers on duty in public is broadly protected, with etiquette that keeps it that way.Licensed, proportionate, documented — or unlawfulPrivate investigatorsPIs exist legally in most of Europe — licensed, and bound by the same GDPR as everyone. Following you needs a legitimate interest that survives a balancing test; bugging, hacking and pretexting never do.Public interest wins — with real limitsJournalists & your nameJournalism gets a carved-out privilege: the GDPR bends to press freedom for genuine reporting. It does not cover everything with a masthead — suspects, victims and bystanders keep enforceable lines.Yes, under statute — with your access rights intactPublic-space CCTVMunicipal cameras need a legal basis, signage and sunset reviews — not your consent. What you keep: the right to see footage of yourself and a hard EU brake on turning cameras into face-scanners.Floor: conditional · Changing rooms & showers: neverGym camerasTraining floors can carry justified cameras. Changing rooms, showers, saunas and toilets are absolute no-camera zones in every country — no exception, no “anti-theft” excuse.Not as the only optionBiometric entry locksFingerprints and face-unlock at doors are Art. 9 biometric data. Convenience never justifies compulsion: wherever they’re offered, a card, code or key alternative must exist for you.Your consent died with the relationship — revoke and removeYour ex & old photosPhotos posted happily during a relationship don’t carry consent forever. You can revoke, demand removal, and escalate — with the fast lane reserved for anything intimate.Not without a basis you almost never gaveSelling your data“We may share data with partners” is where selling hides. Actual sale of identifiable data needs consent that names the buyers’ purposes — vague partner clauses don’t survive contact with a regulator.For security, briefly: yes · For tracking: consent rules applyIP loggingYour IP is personal data — but security logging is the textbook legitimate interest. The line runs at purpose and retention: defending the server yes, profiling the visitor no.Pixel: consent, always · Analytics: consent or hard-privacy configAnalytics & pixelsThe two most-installed trackers in Europe sit on different legal footings — and both fail the way most sites run them: firing before you’ve clicked anything.Fit/unfit yes — diagnoses and jabs, almost neverHealth questions at workYour employer runs the payroll of your sick days, not the file of your diagnoses. The occupational physician exists precisely to keep medical detail away from HR.A lot, by law — with algorithmic limits courts enforceTax authority & your dataTax authorities hold real statutory access: bank reporting, platform earnings, cross-border exchange. What they cannot do — and have been struck down for — is opaque algorithmic suspicion.