GDPR and Taking Photographs in Public Places / at Large Events

Transcript of the Video

Good evening ladies and gentlemen, this is Suzanne Dibble here, Data Protection Law Expert, coming to you, raw and uncut, from the top of the Marina Bay Sands Hotel in Singapore. I know you can't see me, but hopefully, you can hear me. I'm on the 57th floor here, so I wanted to do this video just to change the locations up a bit.

But what I wanted to talk about today is following up on a video, an interview that I did for photographers. And that is in relation to whether you can take photographs in public places or big events, whether you need to get consent, what GDPR is going to do to impact that etc. Now, yes, photographs are now classed as personal data. And yes, obviously, taking photographs and storing them and processing them etc. is processing according to GDPR. But do remember that consent is just one lawful ground of processing. Okay.

So there are a few things at play here. One is GDPR and the other is general privacy laws about taking Privacy laws that have existed for many years about taking photographs in public. And as long as you are not, the photographs aren't going to cause individuals any distress, they're not taken out of context, then generally if you're taking photos of people in public, you'll be okay. It's not illegal to take photos of people in the public without their consent. There are a few places where it is illegal to take photographs, and that's things like Downing Street and places like that, and I'll post ... I think there are about four or five places where you're legally not allowed to take photos, and I'll post those in the comments to this video. But otherwise, if you're taking photos of the public and it's just a general photo and it's not going to cause the individual any distress, then generally you're okay to take that photo without consent. That's the current position without the impact of GDPR.

Now with GDPR, you have to look at what are your lawful grounds of processing, and legitimate interest is a ground of processing where it exists in its right, but certainly, it's one to look at where getting consent is going to be impractical. Now if you carry out your legitimate interests assessment form and work through that, I'm pretty sure you'll come to the conclusion that photographing people at events will fall under the grounds of legitimate interest. Now saying that I've said many, many, many times before, legitimate interests is a very gray area. So if you can get consent and it's something where it's not completely adverse to your interests if they withdraw consent, then look at using consent as a ground because it just puts it beyond doubt then.

So if you are at an event and it is possible to ... Even if it's not possible to ask individually, but you do it on an opt-out basis in terms of you will have posters around the event saying, "If you don't wish to be photographed, then let us know and we'll make sure that you're not in any of the photos." Or you announce, if it's at a wedding and you announce it beforehand and say, "Please make yourself known if you don't want to be photographed" then that is, in my view, the best course of action. You're not going to get any trouble from doing that.

But on the strict interpretation of GDPR, it's very difficult to say for sure because legitimate interests are such a gray area, but it is a balancing test. It is about your legitimate interests and if you are a photographer who goes to, say, sporting events or something like that, and that is your business, then it is clearly within your legitimate interests to carry on with taking those photographs. Now that is balanced with looking at the rights and the impact that your processing of that data will have on the rights and freedoms of individuals. Now are the people you are taking photographs of at sporting events going to have any impacts on their rights and freedoms? Probably not. They're probably going to be quite chuffed that they appear in one of your photos. If they're looking happy and normal and smiling, they're going to be chuffed. If they are maybe in a passionate embrace with somebody and that somebody that they're in a passionate embrace with is not their husband, they might not be quite so pleased. So obviously you need to use your discretion when you are taking photographs in the public. And of course, if somebody is a celebrity and you're taking photos of them in compromising positions, then that is arguable, under GDPR, it's an impact on their rights and freedom and would have to be balanced carefully.

But part of the balancing test for legitimate interests is would those people reasonably be expecting that processing of that data to be taking place in those circumstances? And in my view, if somebody goes to a sporting event where there have historically been photographs taken and they know that those photographs are going to be published, then, yes, that is within their reasonable expectations that you will continue to take photographs.

Please remember that GDPR is not out to get us. It's not out to get small businesses. It's out to get the big guys that do big things with data and don't care about protecting our personal data. It's not here to shut down your photography business that takes photos of horse riding events or whatever it might be. Okay. So do carry out your legitimate interests assessment. You can find the assessment form in my GDPR pack, but I would, certainly me, being a fairly pro-active risk taker, if it was my risk to take and I was taking photographs at horse riding events or large sporting events, I would be fairly confident in relying on legitimate interests to continue taking those photographs. As long as you're sensible and as long as you are using those photographs of people smiling happily, having a good time at the event, and you're not doing anything controversial, then I would be happy to rely on that.

Saying that, do think about the fact that, and I'm sure you do this anyway because this isn't new with GDPR, if you are at a venue, then obviously you need to make sure that the venue is going to permit you to take the photographs in the first place, and as I say, I'm sure you do that anyway. And if you can get consent or at least opt-out consent, then just do that anyway regardless of what GDPR says, it just makes sense. The whole thrust of GDPR is to be upfront about things and you're going to get fewer complaints if you've told people that that's what you're doing and they've chosen to opt out for whatever reason.

So please don't ... I know it's ... The guidance on photography is very limited, but in my view, from everything that I have read, all the guidance notes, it is really not here to get you. So the slight technical non-compliance is not going to get you into any trouble. If you're sensible, if you're using photographs of people, if they're happy and smiling and, enjoying themselves, chances are they're going to be chuffed about it rather than anything else, and there will be no issue. If there was an issue, I think that you would have a good grounds for relying on legitimate interests, but as I say, do carry out the legitimate interests assessment. I can't get my teeth in. Legitimate interests assessment form that's in my pack and document it, and that's the key thing here with GDPR, and particularly legitimate interests. Document your decision-making process so that if there is a complaint and there is an investigation, you can at least back up your decision-making process with some written materials at the time that you actually made that decision.

So I hope you can hear me because it's rather loud here, but I did want to ... It's getting late now and I obviously committed to do a video a day. It's my beloved's birthday today, a big birthday, so we've been out celebrating all day, but I wanted to squeeze this in while he's enjoying another cocktail with his brother. So I hope that helps those of you photographers who are worried about this. As I say, I repeat, GDPR is not out to get us, it’s to get the bad guys. The fines are there for the bad guys. It's to make us all focus on what we do with our data. If you're being sensible and you are having respect for your data subjects, you'll be absolutely fine.

I will catch you tomorrow.