Data Protection
How to comply with data protection requirements when publishing photographs and videos on the internet, and internally
If you are planning a photo or filming session, please note that filming/photography is the processing of personal data, which comes under the General Data Protection Regulation. Whenever individuals can be identified by their image, data protection legislation applies. Individual’s rights in the collection and use of photography must be respected. They must be informed when an identifiable image of them will be or has been captured, and a legal basis must be found before the image is used in any way.
Choose the legal basis that most closely reflects the relationship with the individual and the purpose of publication.
Legal bases for data processing
You might need to create a privacy notice that will inform people how and for what purposes their captured images will be used. We suggest you use the template below (you may want to review it).
If you decide consent is the right lawful basis, you need to ensure it is freely given, with genuine choice and control. It must be targeted to your purpose and easy to understand. There must also be a clear signal from the individual they agree. There are no specific timescales for expiry of consent in GDPR and consent can be withdrawn at any time.
You need to keep evidence of consent including who, when, what and how. Keep it under regular review, and refresh if your purpose changes.
Depending on whether photos/videos depict individual, posed groups or crowds, slightly different rules will apply. Please note that people need to be able to opt-out of their photos being taken. You can either create a photography free zone, hand out coloured badges, wrist bands or ask the photographer to only take photos of the backs of people heads with only a clear image of the speaker.
If you upload photographs of identifiable persons onto the internet (including social media platforms), you very likely have an international data transfer. You will need to ensure, the identifiable persons have consented to international data transferred (it’s reflected in the form above).
Please consult the guidance on International Data Transfer.