GDPR and Photography
Note the author of this blog is not a lawyer!
Unless you have been living under a rock for the past year or so, I’m sure you’ll have heard something about the European Unions General Data Protection Regulations (GDPR) changes that became law in May 2018. However, what you many not be aware of is how this affects you as a photographer, so let me try to explain. GDPR states that photographs containing people that can be identified in any way are to be considered as personal information. This means the images should be handled with care and you must have consent from the identifiable person(s) giving you their permission to 'publish' the photograph. Simply put, photographs of people are now considered personal data, and GDPR is all about the control of personal data.
What Constitutes Personal Data?
Personal data is defined as any information relating to an identified or identifiable natural person. In a computing sense this includes online identifiers, such as IP addresses and cookies if they are capable of being linked back to the data subject. It also includes information such as physical, physiological, genetic, mental, economic, cultural or social identities that can be traced back to a specific individual.
A person’s face is considered as biometric information or data. The GDPR defines biometric data as “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person”. It is one of the “special categories of personal data” that can only be processed if:
The data subject has given explicit consent
Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the fields of employment and social security and social protection law
Processing is necessary to protect the vital interests of the data subject
Processing is necessary for the establishment and exercise of defence of legal claims
Processing is necessary for reasons of public interest
But the people in my photos aren't named so why does GDPR apply? It still counts as personal data! Images of faces can be processed to automatically identify a person, for example Facebook’s auto-tagging of people feature when uploading images or public CCTV analysis software to identify troublemakers in public places.
General advice on GDPR for Photographers
You DO need a clear consent form from anyone and everyone who has agreed to be the primary focus of your constructed studio type photographs where you intend to share the images in the public domain, such as Social Media sites, personal, business or photography club websites.
You DO need to inform your subjects about their data privacy rights. These include...
The right of access – You can receive a copy of the personal data we hold about you
The right to rectification – You can request your personal data to be up to date and accurate
The right to erasure – You can request to have your personal data erased unless it is needed to fulfil a legal obligation
The right to restrict processing – You can request the organisation to stop processing your personal data
The right to lodge a complaint – Your have the right to file a complaint with the data processing authority in your local Country
The right to withdraw consent – It must be as easy to withdraw consent as it was to give it![endif]--![endif]--
You DO Need to keep track of your consent forms for a long time. If you are not careful you can be fined quite a large sum of money.
You DO NOT need a clear consent form from anyone who might appear in the background of your photographs, but you should use common sense. If the image you capture and intend to share might cause offence to the people in them, then you might need to think twice about sharing that image.
You DO NOT need a clear consent form from anyone who might appear in photographs at public events where photography is expected or likely such as sporting events, concerts etc. But use common sense.
There are various websites that you can download release form templates from to ensure you are covered.
Further information can be found below: