What are the GDPR consent issues for photographers and event managers?
There’s a few … and GDPR consent is particularly relevant for photographers, journalists and event managers.
Let’s look at an example. I recently attended a business networking event where the organisers were displaying this notice on some of the tables. This is typical of the sort of response to the GDPR which is bringing it into disrepute.
Clearly there was an attempt here to be light-hearted, but this has to be an example of how not to do it.
Let’s start with the definition of GDPR consent from Article 4:
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
The most obvious problem here is that entering and being present at the event can hardly be seen as an ‘unambiguous indication of the data subject’s wishes’ – about all that this indicates is the wish to be at the event. The only possibility on offer that relates to an unambiguous indication is opting out by contacting the development manager or an event official … and as we all know now consent needs to be opt-in.
Consent must be specific and informed
They were assuming that attendance at the event could be taken as consent for a multitude of activities. However, ‘Specific’ means that there must be some level of granularity. They would need separate consent for each use of photography and filming (what does ‘otherwise recorded’ mean?): for each use and for each medium. This needs a lot of separate consents!
Consent needs to be ‘informed’. The notice provides very limited indication of potential uses of the personal data and it is unclear whether we are meant to take ‘in perpetuity’ seriously. Article 7 of the GDPR says ‘The data subject shall have the right to withdraw his or her consent at any time’ and that the data subject must be informed of this right.
Article 7 also says ‘Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data’. Really? Does a record of someone walking into a room demonstrate consent?
At least they didn’t make ‘consent’ a requirement for attending the event, so, if this were consent, it would have been freely given!
Does that help? Got a question? We can advise on all aspects of data protection and if consent is really giving you a headache sign up for one of our GDPR courses.
Take a look at our page with further information: Photographers & Journalists
Update 16th January 2024: The ICO has released its new journalism code. I am planning to run a course on this new code. If you would like information about it please get in touch.