principle for non-user privacy, to be able to access and remove data …

…uploaded by others (#287)

* addresses #24

related to #135

add principle to consent section to note that consent does not include
non-user, and that functionality must be provided to access or remove data
in those cases

* Apply suggestions from code review

accepting inline suggestions (other changes to be made in a separate commit just for workflow reasons)

Co-authored-by: Robin Berjon <robin@berjon.com>

* re-wording about consent implying consent of non-user
formatting

---------

Co-authored-by: Robin Berjon <robin@berjon.com>

index.html

@@ -1969,13 +1969,27 @@
 <div class="practice">
 <p>
   <span class="practicelab" id="principle-consent-withdraw">
-    It should be as easy for a user to check what consent they have given,
-	to withdraw consent, or to opt out or object,
-	as to give consent.
+  It should be as easy for a [=person=] to check what consent they have given, to withdraw consent,
+  or to opt out or object, as to give consent.
   </span>
 </p>
 </div>
 
+A [=person=] may share data about other [=people=] (e.g. a picture with both that person and others). If that person consents to the processing of that data, this does not imply that those other people have consented as well.
+
+<div class="practice">
+  <p>
+    <span class="practicelab" id="principle-consent-otherpeople">
+      [=Actors=] should provide functionality to access, correct, and remove data about
+      [=people=] to those [=people=] when that data has been provided by someone else.
+    </span>
+  </p>
+</div>
+
+<div class="note">
+  See <a href="#group-privacy">Group Privacy</a> and <a href="#data-rights">Data Rights</a> for
+  further discussion of privacy of people other than the user.
+</div>
 
 ## Notifications and Interruptions {#interruptions}