Photography in the light of the GDPR

  • Author: Niklas Drexler
  • Last updated: 03.07.2023
  • Category: Data Security

Photographs almost always fall under the category of personally identifiable data and are thus subject to the provisions of the GDPR. Is this problematic? Indeed.

As soon as a photo of a person is taken, personally identifiable data is generally involved. Individuals can be identified based on their personal characteristics, such as facial features and stature, if they are sufficiently recognizable. Additionally, digital images are often tagged with metadata, such as location and timestamps.

In data protection law, as outlined in Article 6(1) of the GDPR, the  collection of personally identifiable data is prohibited unless there is a legal basis for doing so. In addition, the data subjects must be informed about the data processing, as stated in Articles 13 and 14 of the GDPR.

However, both of these requirements are almost impossible to fulfil in practice. To imagine that every person accidentally captured in a photograph of a famous landmark, such as the Brandenburg Gate, would have to be asked for permission and informed about the processing of the photograph is an unthinkable scenario.

Does this mean that there can be no more photographs of landmarks with other individuals or even groups of people visible?

Two central questions need to be addressed:

Can the GDPR be based on a legal basis other than consent?

Is there an exception to the obligation to inform the individuals concerned?

According to the Hamburg Commissioner, photographers can rely on Article 6(1)(f) of the GDPR, as their activity generally falls under the concept of art, which allows them to rely on legitimate interests.

With regard to the obligation to inform the individuals concerned, the Hamburg Commissioner argues for the applicability of Article 14 of the GDPR and the exception in paragraph 5. This means that individuals do not need to be informed if they cannot be identified by the photographer or if providing the information would involve a disproportionate amount of effort. Both scenarios are common.

So the good news for all the hobby photographers among us is that (for now) virtually nothing will change.

Interested? Read the full article here.

tourist in Paris visiting landmark Eiffel tower, sightseeing in France, woman taking photo on mobile phone
© Song_about_summer / stock.adobe.com | #164645720

Privacy settings

We use cookies on our website. Some of them are essential, while others help us improve this website and your experience.

In this overview you can select and deselect individual cookies of a category or entire categories. You will also receive more information about the cookies available.
Group essential
Name Matomo
Technical name
Provider
Expire in days 72
Privacy policy
Use Use without cookies
Allowed
Group external media
Name Calendly
Technical name __cf_bm,__cfruid,OptanonConsent
Provider Calendly LLC
Expire in days 365
Privacy policy
Use To arrange appointments via the provider Calendly
Allowed
Name Contao CSRF Token
Technical name csrf_contao_csrf_token
Provider Contao
Expire in days 0
Privacy policy
Use Serves to protect the website from cross-site request forgery attacks. After closing the browser, the cookie is deleted again.
Allowed
Name Contao HTTPS CSRF Token
Technical name csrf_https_contao_csrf_token
Provider Contao
Expire in days 0
Privacy policy
Use Serves to protect the encrypted website (HTTPS) against falsification of cross-site requests. After closing the browser the cookie is deleted again
Allowed
Name PHP SESSION ID
Technical name PHPSESSID
Provider Contao
Expire in days 0
Privacy policy
Use PHP cookie (programming language), PHP data identifier. Contains only a reference to the current session. There is no information in the user's browser saved and this cookie can only be used by the current website. This cookie is used all used in forms to increase usability. Data entered in forms will be e.g. B. briefly saved when there is an input error by the user and the user receives an error message receives. Otherwise all data would have to be entered again
Allowed