GDPR For Photographers

The General Data Protection Regulation (GDPR) is a European privacy law that will go into effect May 25, 2018. It means that there will be stricter restrictions on how individuals and companies collect, process, store and distribute personal data of the EU citizens – regardless of locations. This new regulation also requires an individual to give consent to organisations for them to store his or her personal data, he or she can revoke this given consent at any time.

GDPR affects every organisation based in the EU and/or involved in processing EU citizens' personal data. Since people in the EU can visit your site, this means your are subject to the GDPR.

Under GDPR, personal data means any information relating to a specific person. For example, personal data can be a photograph of a person, name, date of birth, email address, physical address, telephone number, computer IP address, financial information and so on.

The purpose of street photography is normally either artistic or journalistic. As both journalistic and artistic creation are excluded from GDPR, photography of people in the streets and the subsequent photograph processing is normally permitted given that the subsequent processing has the same purpose.

Yes, GDPR also includes photographs (personal data) taken before the new legislation begins to apply. GDPR does not apply if you have artistic or journalistic purposes with the images.

Only if you lack an artistic or a journalistic purpose. However, in general, children's personal data is particularly protected by GDPR. If a consent is required, it must be given by the guardians if the child does not understand the meaning of the consent (the rule of thumb is children under the age of 15).

GDPR does not prevent photography in the context of mingling or other social occasions if it is done in the context of artistic creation or for journalistic purposes. Even in other cases, it may be supported by so-called interest weighting, given that they are everyday images that reveal no more than harmless personal data. An assessment in the individual case based on common sense is recommended. Similarly, it is the purpose of the use that matters.

Consent means asking the person you photograph for a permission. According to GDPR, 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Make sure to do this in writing because it is difficult to show what is said verbally. Do not forget that the consent will apply to any processing you intend to do with the personal data.

We are currently reviewing how we store and use data.
We are reviewing our Terms and Conditions to be more transparent about our use and treatment of data.