Photography by promoters and artists is an integral part of any kind of event. Since the General Data Protection Regulation (GDPR) came into effect, the legal requirements for videos and photos depicting people however have to be reassessed.
In the past, most member states of the European Union had their own regulations regarding photos that show individual persons. In Germany, the Art Copyright Act (KUG) laid out the ground-rules regarding the distribution and publication of such pictures. Under this law, the required consent to the publication of photos of people and thus to the processing of personal data could be given implicitly, based for example on the general terms and conditions of an event.
As European law has primacy over national regulations, this has changed with the GDPR. National laws like the KUG can no longer be taken as the sole basis for the admissibility of event photography. Thus, the questions arise (a) on which legal basis the production and publication of event photos showing people can now be based on and (b) what requirements must be met in this respect.
First, the good news: Explicitly given, GDPR-compliant consent – difficult to obtain in practice – will rarely be necessary. The GDPR also allows processing personal data after balancing the affected interests of (a) promoters and artists on the one hand, and of (b) event participants (hereinafter: data subjects) on the other hand.
Photographs are taken for a range of different purposes. Most frequently, they are intended for internal use and/or to advertise the success of an event. Ultimately, this purpose simultaneously involves promoting comparable events in the future.
In addition, artists – for example bands – often intend to use event photos for illustration purposes, e.g. for albums in booklets. This particular use case can still be based on the German KUG (Sect. 22, 23). Its application is made possible by the opening clause in Article 85 (2) GDPR, which permits national regulations for certain purposes, including artistic ones according to a recent ruling by the Higher Regional Court of Cologne.
With regard to the processing of event photographs for (exclusively) artistic purposes, consent pursuant to KUG can be obtained in advance, for example through general terms and conditions, in accordance with the legal position prior to the GDPR.
The above-mentioned artistic purposes are subject to a case by case decision. Publishing pictures in social networks goes beyond the protected sphere of artistic expression and serves primarily economic interests.
In the case of event photography that pursues neither journalistic, scientific, artistic nor literary purposes, or event photography that is used outside of an artistic purpose, the conflicting interests of the promoter in the creation and publication of these photos must be weighed against the legitimate interests of the data subject. According to the State Commissioner for Data Protection in Brandenburg, recourse can be made to the principles developed in the past regarding Sect. 23 KUG. This provision is merely a statutory base for balancing conflicting interests. Data processors must also take into account the intensity of the encroachment on fundamental rights and liberties, namely
As a rule of thumb, we consider the following basic principles to be a good decision-making basis:
Data subjects must be informed of the data processing in a transparent and suitable manner and at the right time, Arts. 13, 14 GDPR. The data subject also has the right to object to data processing that is based on a legitimate interest. The right to object must be explicitly brought to the attention of the data subject and be presented clearly and separately from any other information, Art. 21 GDPR. This means that pictures published in social media must be deleted immediately following such an objection by way of the notice and take down procedure. In general, photographers hired by promoters and/or artists are also considered to be processors. Thus, a data processing agreement (DPA) must be made with these photographers.
When observing the following rules, event photography can be done in compliance with data protection laws.