The EU General Data Protection Regulation (GDPR) Article 17, the 'right to find and report' or 'right to be forgotten', allows individuals to request that platforms provide information on their personal data in specified circumstances. Intimate images constitute personal data under GDPR (they represent an identifiable individual). NCII distribution involves 'processing' personal data without consent, providing a basis for a reporting request. Platforms must respond within 30 days. Failure to comply can be reported to national data protection authorities (DPAs) with potential fines of up to €20 million or 4% of global annual turnover. This applies to US companies serving EU users.

Key facts about this term

  1. Submit a GDPR Article 17 reporting request to the platform's EU privacy contact Every major platform has an EU privacy contact or Data Protection Officer required by GDPR.
  2. Reference Article 17(1)(a), unlawful processing Processing intimate images without consent is unlawful under GDPR, cite Article 17(1)(a) which covers unlawfully processed data.
  3. File a complaint with your national DPA if the platform does not respond within 30 days Each EU member state has a national data protection authority empowered to enforce GDPR.

Frequently asked questions

Does GDPR apply to US platforms like Google, Meta, and Amazon?

Yes. GDPR applies to any platform processing data of EU residents, regardless of where the company is headquartered. US platforms have EU privacy contacts and GDPR compliance obligations.

Is a GDPR reporting request better or worse than a TAKE IT DOWN Act notice?

The TAKE IT DOWN Act notice has a faster deadline (48 hours vs. 30 days) and more direct enforcement mechanism for NCII specifically. GDPR reporting requests provide a parallel framework for EU-based victims and EU-accessible platforms.

Related glossary terms