Our organization runs and hosts various events. We take photos and use them for our marketing material. Do we need to get participants’ consent?
When considering the data protection ramifications of these photographs, there are three main issues to consider:
Special categories of personal data. Photographs could amount to ‘special categories of personal data’ under GDPR Article 9, because (i) photographs can include biometric data; (ii) photographs could show a person’s ethnic origin and/or religious beliefs, depending on the context.
Lawful basis of processing. In the event that those photographs are not special categories of personal data, we need to consider whether consent is necessary or whether it might be possible to rely on legitimate interest.
Data subject information rights.
Each of these is considered in turn:
1. Special categories of Personal Data
GDPR Article 9(1) defines ‘special categories of personal data’ as: “data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation”.
Are photographs of individuals ‘special categories of personal data’? The answer will depend on several factors, including the use made of the photographs, the context of the photographs and more.
One possibility is that photographs are biometric data, defined in Article 4(14) as “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”. In other words, if the photographs are used with a view to technical processing relating to, say, physical characteristics, such as through facial recognition, then that would make their processing into processing of special categories of personal data.
WP29’s opinion 192 on Facial Recognition, which predates GDPR, states: “Digital images of individuals may in some specific cases be considered as a special category of personal data. Specifically where digital images of individuals or templates are further processed to derive special categories of data, they would certainly be considered within this category. For example, if they are going to be used to obtain ethnic origin, religion or health information can be derived.” This suggests that images of individuals are not always special categories of personal data, only in certain circumstances. Further, GDPR Recital 51 specifically states: “The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.”
So photographs do not constitute biometric data, unless they are processed through facial recognition software, for example. The use of these photographs in advertising materials will therefore not amount to processing biometric data and would therefore not require an Article 9 lawful basis on account of being biometric data, but rather just an Article 6 lawful basis.
It is arguable that photographs may be ‘special categories’ in other respects, where they reveal ethnic or racial data. Any photograph of a person reveals, for example, their skin color. Is that photograph then inherently a ‘special category’ of personal data? It may arguably be so, but under Article 9(2)(e), processing special categories of personal data is permitted where the “processing relates to personal data which are manifestly made public by the data subject”. And data so manifestly made public as a person’s skin color, may therefore not be restricted by Article 9.
2. Lawful Basis
Photos of persons who attend an event may constitute personal data in so far as it is possible to identify an individual from a particular photograph. Consent could constitute a legal basis for such processing, but this is often problematic for several reasons: obtaining consent in the first instance may not be workable, and beyond that even if consent were obtained, this would create additional unworkable situations: for example the need to identify the individuals who did not consent, or who withdrew their consent. And depending on the circumstances, this may not be feasible.
In accordance with Article 6(1)(f), legitimate interest is the appropriate legal basis for taking and publishing photos of JAFI events. The legitimate interest three-part test must be considered: (i) the processing must be necessary; (ii) the interest must be legitimate; and (iii) the rights and freedoms of individuals must not be overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. The implementation of this three-part test is for a DPO, but we note that the rights of minors go, in particular, to the third part, and therefore in general where minors are being photographed, parental consent may be required.
For further detail, see the opinion of the Baden-Wuerttemberg DPA in this regard.
3. Data subject Information Rights
Of course, GDPR Article 13 applies, and data subjects must be informed. When relying on legitimate interest, the data subject should specifically be told the legitimate interests pursued (Article 13(1)(d)), and of their right to object to such processing (Article 21(4)).
Summary: Legitimate interest may provide a legal basis for taking and publishing photos of people who attend events. The individuals must be properly informed, and where minors are concerned consent is more appropriate.
DISCLAIMER: THIS IS NOT LEGAL ADVICE, THESE ARE OUR MUSINGS, BASED ON OUR EXPERIENCE WITH OUR CLIENTS AND COLLEAGUES, AND WERE ORIGINALLY SHARED OR WRITTEN IN A VERY SPECIFIC CONTEXT. YOU CAN DRAW INSPIRATION, AND TELL US IF YOU HAVE INTERESTING COMMENTS, BUT WE HAVE NO RESPONSIBILITY FOR THESE OPINIONS VIS-A-VIS OUR READERS.
www.myedpo.com