While the Beast from the East battered our land, a different storm worried photographers: the new General Data Protection Regulations, or GDPR.
There are a lot of loops that self-employed photographers, like me, have to jump through. One of those loops, the Data Protection Act, changed shape and name. The General Data Protection Regulations, or GDPR, came into effect on the 25th May 2017. However, the General Data Protection Bill (which turned it into British law) did not get it’s second reading until 5th March 2018. Soon after, the Data Protection Act 2018 became law.
I should start by saying that I am not a legal expert and this is how I am interpreting the state of play at the moment after lots of reading and contacting the Information Commissioner’s Office (ICO). There is plenty of other information for small businesses out there about the changes in the law, but not much clear information about photography. So this post is purely about that. It is my interpretation.
Under the current Data Protection Act exemptions exist for photographers for images taken as art and for journalism.
Speaking with the Information Commissioner’s Office they said, “The GDPR allows member states to introduce exemptions/derogations. These will be set out in the Data Protection Bill – it’s likely there will be a similar exemption for personal data processed for the purposes of ‘journalism, literature and art’ ” These exemptions came into play, as did handling data for personal domestic purposes.
Under the old Data Protection Act 1998, there was definite provision for art and journalism.
(1)Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if—
(a)the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,
(b)the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
(c)the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.”
The \new data Protection Act is worded differently.
“Journalistic, academic, artistic and literary purposes
24 (1) In this paragraph, “the special purposes” means one or more of the
(a) the purposes of journalism;
(b) academic purposes;
(c) artistic purposes;
(d) literary purposes.
Schedule 2 — Exemptions etc from the GDPR
Part 5 — Exemptions etc based on Article 85(2) for reasons of freedom of expression and information
(2) Sub-paragraph (3) applies to the processing of personal data carried out for
the special purposes if—
(a) the processing is being carried out with a view to the publication by
a person of journalistic, academic, artistic or literary material, and
(b) the controller reasonably believes that the publication of the material would be in the public interest.
(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.”
That’s a lot of legalese, but I interpret that as: if produced for purely artistic purposes, photography will continue to be exempt from data protection laws.
So, I understand that a street photographer taking candid shots in the street for art is exempt from the the Regulations. The arts are free of constraint, according to the EU Charter of Fundamental Rights.
(I should point out that the current government are making noises about removing us from the EU Charter of Fundamental Rights. So things may change in the future. Our current freedoms of expression may change or disappear altogether.)
If I am reading the law correctly, and I reiterate I am not a lawyer, a professional’s photographs would only be able to be used without the law applying if for journalistic/academic/artistic or literary purposes. When shot for domestic purposes photos are also exempt from the Act.
So, if I took a photograph of you on the street and published it as art, then it would not be considered personal data. I would be carrying out my freedom of expression. But, I do need to limit the use of that photograph to just that purpose. If I were to use your image for advertising, or I sold you copies in return for you letting me use your image, then that becomes data and the GDPR rules come into force. Also, I could not name you in the photograph nor say where you were at what time.
The exemption is unlikely to hold if you enter into a contract with the subject. Therefore, wedding photographers should ask the couples to make their guests aware of who the photographer is and individuals should have the option of not being photographed. That makes life really difficult for documentary photographers. Permission should certainly be sought before wedding shoots are used for publicity.
A contract does not necessarily mean the exchange of money. Just promising to send a copy of a photograph to someone in return for letting you take their photograph is a contract. Then the photographer should get a model release form signed.
Be extra aware of photographing children professionally. Always seek written parental permission before using a picture, sharing it on Facebook or Instagram, even in private groups. If you attend a youth event and promise photographs of the children for a club or organisation, then that is entering into a contract. The new regulations are –quite rightly– very strict regarding protecting children’s data.
This is a regularly debated topic and the answer from the ICO is no.
“In relation to street portraits of individuals; these will not be ‘biometric’ data.” Even so, I would be cautious about uploading to public sites photographs that contain people’s names or other information that may be sensitive.
Most professional photographers were prepared for GDPR. Some won’t.
Those who should worry are all the ‘semi-professional’ or ‘semi-amateur’ photographers who just shoot the occasional event, or sell the odd print. These are often not even registered as self-employed and are not insured. They are unlikely to comply with the current Data Protection Act. The new fine for failing to comply, which includes registration, is jumping up from a few thousand pounds to €10 million.
Carrying out the ICO’s online test, I have to be registered for my work. I would be hard pushed to see any circumstances where a professional photographer would be exempt. If you keep customers or employees data, you need to register.
The ICO are helpful. They are good at giving guidance instead of fines to date, but the new laws are stricter. One complaint from a parent whose child’s photo was shared without permission, or you sending an unsolicited email to a former client without their permission, could start an avalanche of penalties.
Will HMRC or DWP look at people investigated by the ICO? Are they going to jump on those who try making an untaxed income from selling photographs? Will they also be studying the lists of people who are registered with the ICO to see if they are registered as self employed?
Now is a good time to either legitimise your business or step away from it altogether.
For those businesses and individuals who use photographers, searching the ICO database is a good guide to whether the photographer is a legitimate and trustworthy business.
Are you still getting GDPR emails? I’ve enjoyed not responding to them, reducing the cascade of emails into my inbox. Some businesses have clearly ignored the new laws.
The new regulations have confused photographers. This blog post about the topic has been my most popular, still receiving between 50 and 100 hits a day.
I discovered, during my latest conversation with the Information Commissioner’s Office (ICO), that the regulations apply to everyone and not just businesses. So, posting a photo in a local forum of a car parked on double yellow lines might well be in breach of the new data protection laws. The example the ICO gave me was sharing images including people who didn’t want to be seen together. They could pursue their complaint under GDPR.
There are exemptions to GDPR because we have, under the Human Rights Act, freedom of expression. I can share a photo I create for art’s sake. If challenged, I may have to prove my intention in court. If I used the image for commercial purposes, then that use has changed. Entering into a contract with the subject, as I need to do when working commercially, then again things get more complex. But, most amateur photography is art.
Similar freedoms exist for journalism, scientific research and literature. The Human Rights Act is possibly the most important law for protecting photography.
One area I queried with the ICO was Lightroom’s facial recognition facility. The official said this was where the new law was clearly not up to speed with modern technology.
There is misunderstanding about a lot of laws. One misconception is that a photo, once published online, is fair game for anyone to use. That is false. I own the copyright of all the photos I take and articles I write. International law, set down in the Berne Convention, prevents people from using my work without my permission. Breaching the law is a criminal offence, yet many people do so with what they think is impunity.
A magistrate’s court can impose 6-months in prison and/or a fine of up to £50,000 for copyright infringement. In the Crown Court, it’s a maximum term of incarceration is 10 years and/or an unlimited fine. Plus, the person who breaches copyright may have to pay compensation to the victim.
It is not a breach of copyright linking to the URL of a photo from, say, Facebook, even when Facebook creates a preview of the image. However, downloading and using the image is an offence.
I recently had a photographed stolen on Instagram. I had used a hashtag. Unknown to me, someone else had claimed the hashtag as their own and was republishing images using it without seeing the photographer’s permission. This is unlawful. Hashtags on Instagram are there to add context to a photo and to help people find images on a particular topic. If you use someone’s photo without their permission, even if you tag them in a repost, is breaking the law.
Another area that brings confusion is photographing buildings. It is not unusual for security guards to challenge photographers in the street who are capturing the architecture. Despite their insistence, they cannot stop you if you are on public land.
There are a few exceptions but you can photograph most things in the UK from public land. Although there is nothing a security guard can do to prevent you photographing an office block from the outside, once inside a building the situation changes. On private property building owners or their representatives can prevent you from taking photos. If you do, although instructed not to, you are committing trespass. The owner can make you leave. That falls under common law. If you refuse the offence becomes a criminal one, that of aggravated trespass.
Hospitals and swimming pools and many shopping centres display no photography signs.
Police can, of course, move you along if you are causing an obstruction when shooting on the street. Officers can view your images, but they must “reasonably suspect” you are a terrorist before doing so. Officers have the power to view digital images contained in mobile telephones or cameras and to seize equipment that contains evidence of terrorism. They do not have the power to delete digital images or destroy film during a search.