Well whoever took the picture is the one that holds the copyright usually so it's more or less that person's data.
Pictures probably aren't a good example because they are covered by intellectual property laws.
Then let's move on to credit card details. You gave them to me for payment purposes in the course of doing normal business.
Months later, I discover that I can sell my stock of credit card information on the darknet for some nice extra income.
Should I be allowed to do that? What if it weren't credit card details but just postal addresses?
Yes, you should be able to do that, unless you are reasonably certain that the information might be used to commit credit card fraud/identity theft.
If you think they might be used illegally, I believe there are already laws to charge you with that relate to facilitating a crime.
If you don't think they will be used illegally, then what's the harm in selling them to someone else?
Re:GDPR: Removing Monal from the EU
by jimmaswell on Thursday May 17, 2018 @08:37PM
(#17097647)
The credit card example was already illegal by other, more targeted legislation.
Nobody likes getting a lot of junk mail, but it's not the end of the world. I actually got my first credit card from a pre-approved offer found in junk mail.
I think most people agree that unless those pictures are gathered with very specific consent, subject to many restrictions, they are not "my data". This is obviously an extreme example, but the reasoning extends to more data that is considered sensitive. The point being that "data ownership" is a complicated issue.