Please quote the part of EU legislation where it says taking a picture at a public place with someone in it is a breach of privacy and illegal? I bet there is no such law, only somebody's lopsided interpretation of some totally other privacy laws, like regarding keeping a database of private information.
Actually here the law regarding public places was made more lax recently. Now all places to where public has free access like restaurants, bars, shops, malls etc are considered public places. On the other hand taking pictures of anybody who is in his/her house or yard is strictly forbidden (that's why we have practically no paparazzi here).
Technically you're right it's keeping those pictures stored that's bound by the privacy rules. For example on a memory card, film, LR or any other DAM software or storage system (HDD). The same goes for a cabinet with negatives for example.
Practically it's the same for almost all purposes.
I also think that the fact that you have practically no paparazzi in Finland, could be the reason that there are no court cases.
Look at :
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
see for example :
"Article 2
Definitions
For the purposes of this Directive:
(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;"
"Article 7
Member States shall provide that personal data may be processed only if:
(a) the data subject has unambiguously given his consent; or..."
"...or to one or more factors specific to his physical..."
--> a picture seems to fit that part.