What are the GDPR consent issues for photographers and event managers?
There’s a few … and these are particularly relevant for photographers, journalists and event managers.
Let’s look at an example. I recently attended a business networking event where the organisers were displaying this notice on some of the tables. This is typical of the sort of response to the GDPR which is bringing it into disrepute.
Clearly there was an attempt here to be light-hearted, but this has to be an example of how not to do it.
Let’s start with the definition of consent from the GDPR, Article 3:
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
The most obvious problem here is that entering and being present at the event can hardly be seen as an ‘unambiguous indication of the data subject’s wishes’ – about all that this indicates is the wish to be at the event. The only possibility offered for such an unambiguous indication is opting out by contacting the development manager or an event official … and as we all know now consent needs to be opt-in.
They were assuming that attendance at the event could be taken as consent for a multitude of activities, but ‘Specific’ means that there must be some level of granularity. Consent would be required separately for each of photography and filming (is recording meant to be different?), for each use and for each medium. This needs a lot of separate consents!
Consent needs to be ‘informed’. There is very limited indication of potential uses of the personal data and it is unclear whether ‘in perpetuity’ is intended to be taken seriously. Article 7 of the GDPR says ‘The data subject shall have the right to withdraw his or her consent at any time’ and that the data subject must be informed of this right.
Article 7 also says ‘Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data’. Really? Does a record of someone walking into a room demonstrate consent?
At least they didn’t make ‘consent’ a requirement for attending the event, so, if this were consent, it would have been freely given!
Does that help? Got a question? We can advise on all aspects of data protection and if consent is really giving you a headache sign up for one of our GDPR courses.
Take a look at our page with further information: Photographers & Journalists
Update 26th October 2021: The ICO has released a draft version of its new draft journalism code. I am planning to run a course on this new code. If you would like to be kept informed about it please get in touch.