Photography and GDPR

Photographs are a part of everyday life now. When you head out for dinner or to a concert, people are snapping away, videoing, and even going live on Facebook. When they do take these photos and videos, people think nothing about putting them on Snapchat, Facebook, Instagram, and Twitter where they are available for everyone and anyone to see.

In reality, a lot of people might not want their image stored or shared by someone else, especially if it is a company or organisation. This could simply be because of the fear of a bad photo (come on, we have all been there...) or it may be for much more serious reasons such as privacy or legal concerns.

Here are some things to think about when recording, storing, and sharing images of your audiences - along with a handy template you can use at public events to let people know they may be photographed or videoed.

What does GDPR say about this?

Luckily, the law offers protection for everyone regarding this. This is covered in different documents but in this we are going to look at GDPR. If and when you can, you must always try and get written consent from anyone who could potentially appear in photos or videos. You must get the permission of all the people who will appear in a photograph, video or webcam image before you record the footage. That means children as well as adults. You must make it clear:

• Why you are using that person’s image

• Where you will be using it, and

• Who might want to look at the pictures

Photos of Identifiable People

If a person can be identified from a photo or video, then it is classed as personal data so you should treat it like any other personal data - keep it secure and don't store for longer than is needed. And if you're sharing it with third parties - you'll need to get permission for that too.

Recording images of children in general needs careful consideration, but even more so if they are wearing a school or club uniform.

Sensitive Data

GDPR expands the definition of sensitive data to include genetic data, biometric data, and data concerning sexual orientation. It's always a good idea to be extra careful if someone is wearing a uniform that marks them as a member of an organisation such as the PSNI or prison service, or if it's clear from a photo that someone is attending LGBTQ+ specific events like Pride.

Photography and Filming at Events

At larger public events, getting written consent might not be feasible. But you can still be open and honest with your audiences, and share the information with them.

You can let people know that images are being recorded by including the details in event sign-up or ticketing information, by making an announcement at the start of your event, and by including the advice in a theatre programme if you can.

If the event is more informal, or outside, then clear notices explaining that photographs/videos will be taken and if anyone has a problem with that, it should be noted who they can talk to about this. we've provided a downloadable template so you can create your own GDPR-compliant notice.

Personalised GDPR Support

If you have a question that isn't answered above, you can leave us a comment below and we'll do our best to answer. We’re also offering bespoke GDPR workshops for cultural organisations for £150 + VAT, so please drop Sarah an email if you're interested.

Note: This is intended to provide an overview of GDPR and is not a definitive statement of the law. For a definitive guide, check out the Information Commissioner’s Office website.