YouTuber Drama: Filming a Foreigner on a Train — Is It Allowed Under Privacy Principles?

Following an incident where a travel YouTuber posted a video clip while walking to their seat on a train during a trip to the provinces, at one point in the footage the YouTuber and their travel companion inadvertently filmed a foreign tourist and their family. The foreign man informed them that he did not want to be filmed, which led to an argument. The YouTuber refused to back down, insisting that filming on the train was permitted since it is a "public space" and that they had the right to film, stating: "I'm not filming you — the train is a public space, I have the right to film." The video was subsequently posted on social media, even though the foreigner's face had been blurred. So, was any of this actually permissible? We will explain below.

Can You Film or Record Video?

First, we must understand that under the Personal Data Protection Act (PDPA), a YouTuber is considered a "Data Controller", which carries legal responsibilities — whether collecting, using, or disclosing such data, they must protect it accordingly.

In this case, while filming itself is generally permitted, the foreign national had already explicitly refused to be filmed. Regardless of whether the location is a public space or not, under Section 32 of the PDPA, the data subject has the right to refuse the collection of their data. Therefore, as a "Data Controller," the YouTuber was required to remove the image of that individual from the footage. Under Sections 19 and 24, a Data Controller may not collect, use, or disclose personal data without the consent of the data subject.

Furthermore, publishing the clip made things considerably worse, triggering additional provisions. Section 26 prohibits Data Controllers from collecting data without the data subject's consent. While accidentally filming a foreigner in passing might not directly fall under this section, the clip in question included a segment where the YouTuber visibly expressed displeasure, and the way the content was framed on social media effectively exposed the data subject to public criticism — bringing the act clearly within the scope of this provision.

Sections 21 and 23 are also applicable, as the YouTuber told the foreigner "I'm not filming" yet still published the clip. Even with the face blurred, the family of the data subject was still visible in the footage — constituting a use of data contrary to the purpose communicated to the data subject. A Data Controller is required to inform the data subject at the time of collection, and must limit data collection to what is necessary in line with the data subject's wishes. Neither condition was met here.

Section 20 is also relevant, as the clip contained footage of the foreigner's daughter's face, and he had already refused consent. This constitutes the collection of personal data belonging to a minor who has not yet reached the age of majority, which requires parental consent. This also potentially constitutes a violation of COPPA, a law specifically designed to protect the personal data of children under the age of 13.

Is It Really a Public Space?

A public space is a place that any member of the general public can freely access and use, with no restriction to any particular individual. However, it is worth noting that seats and areas within a train carriage are not strictly public spaces — they are state property made available to passengers under a contractual arrangement through the purchase of a ticket, granting the right to use a seat for travel purposes. In other words, it is a semi-public space. That said, being a public space does not mean the PDPA does not apply — the law remains fully in effect regardless.

What Would Happen If This Occurred Abroad?

TikTok Star Accused of Secretly Filming Women on the Beach

Authorities in New South Wales, Australia, are investigating a TikTok star who was found to have used smart glasses with a built-in video recording function to film women while approaching them in areas around Sydney and Melbourne, without their knowledge. The footage was edited and published on TikTok as "flirting" content. Some victims later demanded the videos be removed, but were ignored. While no penalty has yet been handed down, under New South Wales law, covert filming or unauthorized publication carries a maximum sentence of 5 years' imprisonment.

Disney Fined $10 Million for Collecting Children's Data on YouTube Without Consent

The U.S. Federal Trade Commission (FTC) announced that Disney and its affiliated companies had collected data from children under the age of 13 without parental consent. The FTC investigation found that Disney's YouTube channels used default channel-level video labeling settings, causing hundreds of videos not to be flagged as children's content. The data collected included Device IDs and usage data — actions found to be in violation of COPPA.

YouTubers, Influencers, and KOLs Need to Rethink Their Approach

Whether you are an Influencer, KOL, or YouTuber, you must understand that you cannot film whatever you like at will. Whenever you are producing content on any platform, you are responsible for what you film and post, in order to remain compliant with personal data protection law. Each time you film, you should remember:

• Obtain consent before filming or photographing other individuals

• If consent is not given, do not film or photograph them

• Do not use or publish another person's personal data without their consent

• If publication is unavoidable, you must edit, mute, blur, or otherwise completely anonymize the individual so that they cannot be identified

If you require further guidance — whether you are a YouTuber, Influencer/KOL, or a Brand — you are welcome to contact Epsilon Legal to arrange in-house training or an organizational compliance assessment.