I’m sure you’ve all received emails recently from various companies about updates to their policies and T’s & C’s. You may have even heard adverts on the radio about it. GDPR isn’t the simplest topic to get your head around, and some of the information out there can be vague and confusing.
As a business, there’s plenty of reason to take GDPR seriously; it’s a new legislation that we all need to adhere to unless we want to be fined up to €20 million, or 4% of annual global turnover (whichever is higher). But what does it really mean for you as a stock photographer?
In the words of LCpl Jones “Don’t Panic!”. We’re going to lay it out for you in plain English, or at least attempt to…
What is GDPR?
- GDPR stands for General Data Protection Regulation
- It is new EU legislation that comes into effect on May 25th, 2018
- It is being introduced to create harmonious and stricter regulations about data privacy laws for all EU citizens
- Any company that handles the data of EU citizens must be compliant
What is the Purpose?
The main purpose for GDPR is to better protect the individual, and to help us all gain control over our personal data and how it’s being processed. There are two different types of data to consider here – personal data and sensitive data. Personal data is data that can be used to identify a person (e.g. name, address, email address and phone number), whilst sensitive data is data that determines a specific person’s personal beliefs, behaviour, health, sexual orientation and so on. Marketing laws have also been tightened and it should be easier than ever to stay on top of what type of emails you receive in your inbox.
We’ve made some changes here at Alamy, and you are now asked when signing up, whether you would like to receive marketing and 3rd party emails from us. Our marketing emails include a lot of industry insight, latest photography tips and trends, whilst 3rd party emails often promote a photography competition or a photography related offer. We’d like you to know that a partnership like this would never involve us sharing your data.
If you’re unsure whether you are opted in or out you can check it the Account Settings section of your dashboard.
How does this affect photographs?
GDPR doesn’t explicitly state that photographs constitute personal data. However, as has always been and always will be the case, different countries will have different privacy laws. You should check that by uploading an image to Alamy that you aren’t breaching any country specific privacy laws. In the UK, the Information Commissioner’s Office (ICO) states that to be deemed personal data, a photo needs to be processed to learn something about an identifiable individual within the image.
How does this affect Alamy contributors?
Alamy believes that the key risk scenario arising from the GDPR is where a photograph with a living person as its main focus, is linked with personal information identifying that person, such as name, address or location. Our contributor contract has been changed as of May 25th, 2018, to note that linking such personal information to a photograph of a living person will only be allowed for journalistic and news reporting purposes, where the person has given consent or for other legitimate reasons.
The journalism and news reporting exception permits images of celebrities/well known or newsworthy people to be used. The legal basis for the processing would be the exemption for journalistic purposes set out in the GDPR (Art 85).
What if you have a model release form? This is the consent exception, so if you’ve got a signed model release, you may name the person, but bear in mind; Is it integral to the image? An image of a friend gardening can make a good stock photo, but they don’t need to be named. So, unless naming your model is essential, it might be best to leave it off.
A good example of “other legitimate reason” is information that are of clear interest to the general public and that are used where it would be expected and natural within that context. For example, the use of an architect’s or inventor’s name in conjunction with a building or invention.
What about Live News contributors?
You should also comply with the Independent Press Standards Organisation, Editors’ code of Practice, found and kept current here.
Although it’s not legally required, editors of newspapers want to know that subjects have given consent, especially if the subject could be considered vulnerable (i.e. Child eating ice cream or young woman sunning themselves).
Getting consent whenever possible could boost your news sales and might give you a contact for future photo shoots.
You can be compliant with GDPR and include details in your caption if you:
- Introduce yourself, tell the subject what you are doing, why you are taking pictures and where the pictures will go
- Ask if they mind being photographed and that their pictures will be seen by the UK Nationals and other International Media
- If they say no, thank them and move on
- If they say yes, make sure some details are included in the caption or that you write consent has been given in the caption
Examples of captions:
Joey, 3 years old from Wiltshire enjoys his favourite ice cream flavour, chocolate, while visiting Bournemouth beach for the first time.
A student from Oxford University studies Biology on the bank of the Thames. Consent has been given for this photo.
In summary
- Different countries have varying severities of privacy laws, and you should adhere to them
- Under the ICO, photos aren’t considered personal data
- When you process a photo to identify a person, this becomes personal data, and could get you in trouble if you have not followed best practice
- You should only identify a person for journalistic/newsworthy purposes, if you have explicit consent, or if there is another legitimate reason
- As always, if you don’t have a release, the image should only be able to be used editorially
Phew, glad that’s over with. However, if you fancy some more reading, you can download the ICO’s Guide to GDPR.