March 27, 2019
In short – sometimes they will, sometimes they won’t.
The key issues at play are:
i) does a photograph amount to “personal data”?; and
ii) did the individual being photographed reasonably expect privacy at the time of the photograph being taken?
Let’s look at each in turn:
i) Most of the time, photographs will be “personal data” provided that an individual can be identified from that image. In fact, any information which can be used to identify a living individual will usually amount to personal data under the GDPR. If you need a bit more information on this, we recently discussed what is (and isn’t) personal data here: https://www.briffa.com/blog/gdpr-what-is-personal-data/
As such, assuming the photographer falls within the material scope of the General Data Protection Regulation (GDPR) the photographer should ensure he has a “legal base” to process such photographs. This is where the second question comes into play.
ii) So, why is it important to consider whether the individual reasonably expects privacy? Well, it’s important because this will determine whether “consent” is, or is not, required.
To simplify matters, a photographer will only need to obtain consent from an individual where no other “lawful bases” for processing that data can be relied on. There are many other “lawful bases” available, including the infamous “legitimate interest” base.
If a photographer can be shown to have a “legitimate interest” in taking and using the person’s image, and this interest is balanced with the negative impact likely to occur for the individual, a release form (i.e. consent) is unlikely to be required. In other words, we recommend taking the following into consideration when assessing whether or not a release form is required:
• does the individual actively want to be on camera (e.g. an actor)?
• does the individual know they are being filmed?
• Is the individual aware of all purposes for which the image will be used (and is this likely to impact upon the individual’s rights and freedoms)?
• Where is the photography taking place (public or private location)?
• If in a private setting, has the individual been notified that filming is taking place?
If the individual reasonably expects to be filmed, and the resulting negative impact on the individual is low (for example, the image will not be distributed widely, or the individual is paid for the image to be taken), “consent” is unlikely to be an absolute necessity; there is likely to be a “legitimate interest” pursued by the business and the resulting negative impact on the individual is low.
The above said, every case will be different. If you need to talk your release forms through with us, please contact our data protection team for a free consultation.
Transferring personal data between the EU and the US just got a little bit easier
Last month, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. The decision means that the European Commission is now satisfied that the US ensures an…
We’ll start with a no obligation chat where we’ll get to know you and understand your current challenges.
Book your free consultation now