An image of a person will be their personal data if they are identifiable from that image. If they are not identifiable, then you can proceed without concern. Where an image of a person is so small or blurred the individual cannot be identified then you won’t need to consider data protection laws.
If you are an individual taking photos for domestic or personal use, data protection laws do not apply to you. However, if you are going to submit a person's image as part of your submission to World Photography Day (or elsewhere on a publicly accessible website) then you are now "using" that person's personal data. In this case it's a good idea to obtain their consent so they know what you are doing with their image and have an opportunity to object. Individuals have a reasonable expectation of privacy and don’t necessarily expect to see their image displayed across the internet.
For photographers more generally, whether you work for yourself or as part of a wider organisation, you must consider your legal basis for processing that individual's personal data.
The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever you process personal data. For a photographer, the most likely lawful basis of processing will usually be either (i) consent, or (ii) for the purposes of performing a contract, or (iii) where you have a legitimate interest.
Consent
Consent must be informed and freely given. You need to be clear as to your intent to publish your photo and where it will be published.
You should also:
- make it clear which organisation (and any third party) will be relying on the consent obtained;
- make the request for consent separate from any other terms and conditions;
- request a clear indication of consent (this could be verbal, ticking a box or providing a signature);
- keep a record of that consent and how it was given;
- use simple, clear language that is easy to understand to obtain consent;
- specify how the personal data will be used. If you are going to use it in more than one way then you need individual consent for each different type of use;
- keep track of the images and where they have been sent or published;
- keep images safe and secure; and
- tell individuals they can withdraw their consent at any time.
If you are taking photos of children under the age of 12 then you must obtain the consent of their parent or guardian. The age of 12 is a recommendation (rather than a legal requirement) and, in each case, you should consider whether the child understands what you are asking them. Although parental or guardian consent is not technically required over the age of 12, it is a good idea to obtain this. In particular, schools will tend request parental or guardian's consent for the duration of the child's attendance at school.
The benefit of consent is that it makes people aware of what you are doing with their image. However, if a data subject does withdraw consent (and you have relied on consent as your legal basis) then you are required to withdraw the image from any forum or publication within your control. This doesn't apply to anything outwith your control, for example, if a prospectus or programme has already been published.
Contract
An example of this is where you may have a contract with a model then you must process that model’s personal data in order to comply with the terms of that contract. This would also cover contracts of employment where a photo is required for an ID badge. However, this does not automatically extend to publishing an employee photo on any internal website and consent should be obtained for such a use.
Legitimate Interests
"Legitimate interest" means where you use an image in ways an individual would reasonably expect and which have a minimal impact on the person's privacy. If you are taking photos of crowds or large groups then individuals may not be individually identifiable. However, if individuals are identifiable, you can consider your legitimate interests as your legal basis for taking a photo. This may apply when you have arranged to take photos at a conference or event. You have a legitimate interest is taking photos to record and publicise the event in the future. However, you should always follow some simple steps to keep attendees informed. If you can, inform attendees prior to as well as at the event (for example, through the registration forms, online media and notices at the event). The photographer should identify themselves and inform people prior to taking a photo (to allow people to move away).
It is always advisable to obtain consent from your data subject and keep them informed prior to taking and publishing a photo even if you are not relying on consent as your legal basis. This at least makes them aware that you are capturing their image and what you will do with it.
Copyright
Photos are an artistic work and are therefore automatically protected by copyright. Copyright applies automatically and it is not a right you require to register. The copyright owner will be the first creator of the work which in most cases is the photographer. If an animal has taken the photo (per the "Monkey Selfie" case) then again, the photographer will own the copyright as the monkey has no legal personality. However, if you have taken the photo as part of your employment, the copyright will usually be owned by your employer so you should check your contract.
In today's digital age it can be frustrating how easily it can be to copy and manipulate someone else's images without any credit to the original creator. There are ways in which you can protect your copyright. Keep records and data trails of the images. You can embed data in the digital images (meta data) or super impose a watermark over your images. If someone then starts using your image without your permission, then all the original ownership data will be there. Protecting your copyright will also help if you want to take legal action against unauthorised use. Copyright can also assist in bringing in extra income from either licensing or selling your rights.
If you have any questions regarding processing personal data or protecting your intellectual property rights then please get in touch with our Corporate team. Meanwhile do enjoy the images at www.worldphotographyday.com.
