Event photography in times of the General Data Protection Regulation

Photography by promoters and artists is an integral part of any kind of event. Since the General Data Protection Regulation (GDPR) came into effect, the legal requirements for videos and photos depicting people however have to be reassessed.

The effect of the GDPR

In the past, most member states of the European Union had their own regulations regarding photos that show individual persons. In Germany, the Art Copyright Act (KUG) laid out the ground-rules regarding the distribution and publication of such pictures. Under this law, the required consent to the publication of photos of people and thus to the processing of personal data could be given implicitly, based for example on the general terms and conditions of an event.

As European law has primacy over national regulations, this has changed with the GDPR. National laws like the KUG can no longer be taken as the sole basis for the admissibility of event photography. Thus, the questions arise (a) on which legal basis the production and publication of event photos showing people can now be based on and (b) what requirements must be met in this respect.

The legal basis for event photography

First, the good news: Explicitly given, GDPR-compliant consent – difficult to obtain in practice – will rarely be necessary. The GDPR also allows processing personal data after balancing the affected interests of (a) promoters and artists on the one hand, and of (b) event participants (hereinafter: data subjects) on the other hand.

Photographs are taken for a range of different purposes. Most frequently, they are intended for internal use and/or to advertise the success of an event. Ultimately, this purpose simultaneously involves promoting comparable events in the future.

In addition, artists – for example bands – often intend to use event photos for illustration purposes, e.g. for albums in booklets. This particular use case can still be based on the German KUG (Sect. 22, 23). Its application is made possible by the opening clause in Article 85 (2) GDPR, which permits national regulations for certain purposes, including artistic ones according to a recent ruling by the Higher Regional Court of Cologne.

Our recommendation:

With regard to the processing of event photographs for (exclusively) artistic purposes, consent pursuant to KUG can be obtained in advance, for example through general terms and conditions, in accordance with the legal position prior to the GDPR.

The above-mentioned artistic purposes are subject to a case by case decision. Publishing pictures in social networks goes beyond the protected sphere of artistic expression and serves primarily economic interests.

In the case of event photography that pursues neither journalistic, scientific, artistic nor literary purposes, or event photography that is used outside of an artistic purpose, the conflicting interests of the promoter in the creation and publication of these photos must be weighed against the legitimate interests of the data subject. According to the State Commissioner for Data Protection in Brandenburg, recourse can be made to the principles developed in the past regarding Sect. 23 KUG. This provision is merely a statutory base for balancing conflicting interests. Data processors must also take into account the intensity of the encroachment on fundamental rights and liberties, namely

• whether the persons in the picture are to be regarded incidental to the actual subject-matter ,
• whether the photograph is a group or individual photograph,
• whether the data subject is aware of the fact that photos might be taken or whether it was taken secretly,
• whether the photo depicts the data subject in an unfavorable manner or in his/her private sphere, as well as
• whether the event was accessible to the public.

As a rule of thumb, we consider the following basic principles to be a good decision-making basis:

• Long shots of the event as well as photos of large groups that mainly capture the overall impression of the event and in which the individuals recede into the background (i.e. are to be regarded incidental to the actual subject-matter), can be taken and used for PR purposes or for internal communication according to Art. 6 (1) lit. f of the GDPR. The same applies to photographs of persons that play a central role in the the event, such as speakers or bands.
• Artists and promoters will not be permitted to automatically process photographs of small groups or individual persons on the legal basis of a legitimate interest. In such photographs, the focus lies on the individuals, hence their interests and rights as data subjects have greater importance when balancing the conflicting interests. A legitimate interest can be therefore only used as a legal basis with caution and care. We therefore recommend the photographer to ask the persons for their consent prior to taking photographs. If this is not possible or appropriate (e.g. in order to capture an animated conversation of a small group), "approval" of the picture should at least be obtained subsequently. If one of the data subjects does not consent to the photograph, it must be deleted immediately.

Which additional data protection requirements have to be observed?

Data subjects must be informed of the data processing in a transparent and suitable manner and at the right time, Arts. 13, 14 GDPR. The data subject also has the right to object to data processing that is based on a legitimate interest. The right to object must be explicitly brought to the attention of the data subject and be presented clearly and separately from any other information, Art. 21 GDPR. This means that pictures published in social media must be deleted immediately following such an objection by way of the notice and take down procedure. In general, photographers hired by promoters and/or artists are also considered to be processors. Thus, a data processing agreement (DPA) must be made with these photographers.

Summary

When observing the following rules, event photography can be done in compliance with data protection laws.

• Basic rule: The more a photograph focusses on the event in general and the less attention lies on the depicted individuals, the higher the legitimate interest of the promoter;
• Conclude an agreement with external photographers regarding data processing,
• Provide transparent information for data subjects (visitors, employees etc.),
• React immediately to objections by data subjects.