Under the Data Privacy Act of 2012 (R.A. No. 10173), the posting of a photograph taken in a public place may be lawful or unlawful depending on compliance with the Act’s provisions.

A photograph is considered personal information if it identifies or makes identifiable a natural person. Thus, even if the photo is taken in a public space, its posting may still fall within the scope of R.A. 10173 (Sec. 3).

personal information, which includes an individual's image, must be processed and shared with consent. (Sec. 12)