The General Data Protection Regulation (GDPR) applies to any processing of personal data including (digital) photography – exceptions are rare. For photojournalists, photographers, artists and others, this means high legal requirements for the justification of their activities, information requirements towards data subjects and in regard to fulfilling data subjects’ rights. In case of violations to these requirements, there is a threat of drastic sanctions. Hence, involved persons need legally sound and pragmatic solutions.

1. Lawfulness of Processing

In order to process personal data in line with data protection law photographers require, one of the following justifications (see 1.1 to 1.3) to be in place. Exceptions apply only to pictures taken in purely personal or household activity context (see 3.) and for pictures being taken for journalistic purposes (see 4.)

1.1. Performance of Contracts

Processing personal data (also in the context of digital photography) is justified where required to carry out contractual obligations towards the data subject (Art. 6 (1) (b) GDPR). This may in particular be the case for photographers work for depicted persons, e.g. when taking pictures for modeling, advertising or product marketing purposes. Often, there would be a contractual arrangement in place governing photographer’s remuneration, permitted use of pictures etc. In such case, production and distribution of the photos serve contractual purposes and may be justified under data protection law.

Such justification would, however, not cover pictures show third persons not being party to the contractual arrangement. In such case, the photographer would require e.g. their consent (Art. 6 (1) (a) GDPR) or justified interests being in place (Art. 6 (1) (f) GDPR).

1.2. Legitimate Interests

Processing of personal data is justified under Art. 6 (1) (f) GDPR where and to the extent required to carry out legitimate interests and there are no prevailing data subjects’ interests found. This justification may apply e.g. in the context of pictures being taken on the occasion of major or public events.

To assess whether or not this justification applies, one must establish legitimate interest of an economic, legal, ideal or factual nature. This would often be the case. Then one must determine whether or not there are opposing interests of the depicted person, taking into account any circumstances being relevant to the data subject when taking the picture. Where the persons are likely not open for being depicted (and e.g. turning away) one should refrain from taking any pictures.

1.3. Consent

In case no statutory justification is in place, processing personal data requires the data subjects’ consent.

Consent must be given freely and in full knowledge of the circumstances of the processing, but does not require any specific form. According to Art. 7 (1) GDPR, a photographer must be able to prove that the person photographed has consented. A nod, a friendly grin or a demanding stare into the camera can be such a consent, however, providing proof may turn troublesome.

2. Transparency of processing

Regardless of the justification, the photographer must provide information on the processing to affected data subjects according to Art. 13 GDPR. There is room for interpretation on how to provide sufficient information and hence room for creative solutions. In case of contractual arrangements, a written information document would typically be the means of choice; while for closed events, notice boards at the entrance of the venue may serve this purpose. For large and public events, clearly visible information tags attached to the photographer may do the trick.

Information to be given must include

• identity and contact details of the controller,
• contact details of the data protection officer,
• purposes of the processing and justification and
• data recipients.

3. Non-Application of GDPR for Private and Family related Activities

GDPR and data protection law does not apply to activities in strict private or family related setting (e.g. private pictures of a family celebration) – so-called household exception under Art. 2 (2) (c) GDPR.

4. Non-Application of GDPR under Media Privilege

Pictures being taken journalistic purposes, fall under the so-called media privilege. The 1907 German Art on Artistic Creations (KUG) stipulates that pictures are justified under widely applicable consent requirements or further justifications. Such justifications e.g. include pictures of persons being part of contemporary history or persons being mere “accessories” to depicted landscapes. Hence, under KUG, pictures of famous persons (e.g. the Chancellor) or pictures of larger groups of persons e.g. on the occasion of a demonstration are permitted. Whether the KUG applies in a GDPR context is subject to legal debate.

Art. 85 GDPR provides for the media privilege and allows the Member States to implement exceptions to the GDPR to protect freedom of expression and rights to information. Whether the KUG is such legislation is subject to legal debate. In practice, the KUG principles are applied regardless of the underlying legal argumentation. Therefore KUG are then taken into account within the framework of the justification under data protection law. In other words: If the criteria of Art. 23 KUG satisfied, there is a justification under the principle of justified interests (Art. 6 (1) (f) GDPR). Good news and relief for press photographers.

5. Recommended Action

Photographers should check whether data protection law applies to their activities. In particular, private and family related pictures may hence be permitted. In any other cases, there is a need for justification under justified interests principles, consent or requirements to comply with contractual obligations towards data subjects.