GDPR - Grim Day for Photographers Really
The cautious line being taken by the University's central administration in the light of the Data Protection Act 2018 will have a significant impact on the images used on our website.
Posted
Time to read
The thrust of a recent presentation to an audience composed of people working in this university who have some responsibility for taking/publishing photos on University websites and in print publications - would suggest that the way I have taken and used the image above is not compliant with the Date Protection Act 2018 and its codification of the EU General Data Protection Regulations (GDPR). The argument runs that the breach of the regulations lies in the facts that:
- The images of the faces constitute personal data.
- GDPR Article 4 states that, "‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly..."
- We do not hold consents from the subjects of the photos for the use of that personal data.
- Actually, on this occasion, and many like it, we did not even seek consent.
However, I suggest that it is possible to take a different position. To start with the ideas that underpin this regulation, this is how the page headed 'What is considered personal data under the EU GDPR?' begins:
|
"The EU’s General Data Protection Regulation (GDPR) tries to strike a balance between being strong enough to give individuals clear and tangible protection while being flexible enough to allow for the legitimate interests of businesses and the public. As part of this balancing act, the GDPR goes to great lengths to define what is and is not personal data." |
Having set that particular tone, the page goes on to offer some detailed definitions of some terms, including some concrete real-world examples, one of which is of particular interest in this case:
| "...a photo of a street in the hands of a photographer is not personal data, while that same photo in the hands of an investigator who is working to identify the individuals and vehicles that were present on that street at that particular time would be considered personal data for the individuals concerned." |
That example is only partly relevant here, as a photo of a street scene that happens to include some identifiable people is not the same as the photo on show on this page, which is quite specifically 'about' the people in it. This photo would not have been taken if those people had not been present, while the opposite is true of the hypothetical street scene. There is no argument about the fact that this is personal data, but one key point that the passage illustrates is that not all uses of an image are equal, which leads us on to...
Exemptions
What are exemptions?In some circumstances, the DPA 2018 provides an exemption from particular GDPR provisions. If an exemption applies, you may not have to comply with all the usual rights and obligations. There are several different exemptions; these are detailed in Schedules 2-4 of the DPA 2018. They add to and complement a number of exceptions already built in to certain GDPR provisions. This part of the Guide focuses on the exemptions in Schedules 2-4 of the DPA 2018. We give guidance on the exceptions built in to the GDPR in the parts of the Guide that relate to the relevant provisions. The exemptions in the DPA 2018 can relieve you of some of your obligations for things such as:
guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ib2 |
What exemptions are available?
Journalism, academia, art and literatureThis exemption can apply if you process personal data for:
Together, these are known as the ‘special purposes’. The exemption relieves you from your obligations regarding the GDPR’s provisions on:
guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ex16 |
But this begs two important questions - is what we're doing here journalism, and are we journalists when we do it? The answers can readily be found elsewhere on the Information Commisioner's Office website. The introduction to the Exemptions section referenced above states that:
What’s new under the GDPR and the Data Protection Act 2018?Not much has changed. Most of the exemptions in the Data Protection Act 1998 (the 1998 Act) are included as exceptions built in to certain GDPR provisions or exemptions in the Data Protection Act 2018 (the DPA 2018). guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ib1 |
So, to find guidance on those provisions of the DPA 1998, we need to examine the ICO's 2014 document 'Data protection and journalism: a guide for the media', - where this particular point is explored in depth:
|
The exemption breaks down into four elements:
|
Further:
|
"Journalism, art and literature are interpreted broadly. This will include most of the day-to-day business of media organisations, and may also cover some activities of others (eg citizen bloggers or civil society groups)" |
and:
|
"Non-media organisations We also accept that non-media organisations may be able to invoke the exemption. |
So, it seems to me that a photo accompanying a news item on our website would be journalism.
I would go on to suggest that - while it will often be possible to be fully compliant with the University's interpretation by, say, getting formal consent from a guest speaker - an argument can readily be made that a photo like the one above of the speaker in conversation with someone in the body of a crowd, with identifiable faces behind, would not require consent from everyone in it, on the basis of the four numbered criteria cited above.
(Rather ironically, the use of this photo on this particular page may perhaps be a breach, as the page isn't intended 'for general public consumption'.)
Share