World Photography Day is an annual, worldwide celebration of the art of photography. WorldPhotographyDay.com invites participants to submit photos to be featured on its site. Many of the amazing images submitted capture an individual data subject, and it is important for photographers to consider the legal implications of data protection laws where personal data is relevant.
There is a common misconception that a photograph only contains personal data if the person featured in the photo is also named. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data.
The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever you process personal data. For a photographer, the applicable lawful basis of processing is usually consent (where an individual has given clear consent to allow the photographer to process their personal data for a specific purpose), legitimate interest (where the photographer uses people’s data in ways they would reasonably expect and which have a minimal impact on the person's privacy) or contract (where the processing is necessary for a contract the photographer has with the individual).
If consent is the right lawful basis of processing, then the photographer must keep evidence of consent including who provided consent, when consent was given, for what purpose was consent provided and how the consent is recorded. Consent means offering individuals real choice and control. In capturing consent photographers must:
- name the photographer's organisation and any third party who will be relying on the consent obtained;
- make the request for consent separate from any other terms and conditions;
- ask people to "opt in" as an indication of consent (this could be ticking a box or providing a signature);
- use simple, clear language that is easy to understand to obtain consent;
- specify how the personal data will be used, and provide a separate option for consent for each type of processing (that is don't seek a general consent for multiple purposes of processing);
- obtain the consent from a parent or guardian if children under the age of 13 years are clearly recognisable in an image; and
- tell individuals they can withdraw their consent at any time (however this will not affect the processing of personal data prior to consent being withdrawn).
Another common misunderstanding is that photographers must obtain consent every time a photo is taken of an individual. If, for example, a photographer has a contract with a model to take pictures of the model, then the photographer must process the model's personal data to comply with the terms of the contract. Or, for example, where a photographer is engaged to take pictures of employees at a work related event, the employees would reasonably expect work-related photos to be taken of them and the photographer can use legitimate interests as the lawful basis for processing rather than consent. In the latter example it is good practice to have notices clearly visible at the event regarding the photography taking place, and to respect the wishes of any employee who does not wish to be photographed.
Photographers must decide the appropriate lawful basis of processing personal data on a case by case basis. If you have any questions regarding processing personal data in photographs or any other data protection questions then please get in touch. Meanwhile do enjoy the images at World Photography Day Photos.
The content of this webpage is for information only and is not intended to be construed as legal advice and should not be treated as a substitute for specific advice. Morton Fraser LLP accepts no responsibility for the content of any third party website to which this webpage refers. Morton Fraser LLP is authorised and regulated by the Financial Conduct Authority.