Good news for many, contrary to what I had previously been told prior to the new Data Protection Act 2018 came into force, their officer tells me that private individuals are now exempt from the regulations. So, GDPR does not apply to people handling personal data in the course of exclusively personal or household activity. This does not exempt you if you work from home! The moment you start to trade, take part in any economic activity, you are no longer a private individual!

For many professionals, it may be difficult separating some work from home. Many of my friends have also become my clients. So, I treat all photographs of people as personal data.

For those of us that are professional, facial recognition in Lightroom is personal data. (I’ve turned mine off.)

They told me that crowd photography (probably) isn’t considered personal data.

Wedding and event photographers should give the attendees the right to opt out of the photos.

” The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.
…
The right only applies to information an individual has provided to a controller.”

The raw files from a camera is not provided by the individual but generated by the photographer, so portability does not apply to it.

At a common sense level I agree that a raw image is created rather than the facial data being provided, and that does exclude it from data portability. If only the ICO had thought this through during those long years of planning..

Hi Cedric, I haven’t heard back from the ICO yet, but I haven’t forgotten your question. I have been discussing it with some legal eagles and they agree with me that as the customer has not provided the raw data in a raw image and it is generated by the photographer, the photographer is not obliged to share it; it is not regarded as portable.

You are right that they didn’t think it through; the ICO said as much to me when I told them about Facial Recognition software built into Lightroom.

They are the experts and I have asked them to clarify the portability issue. I am awaiting a reply and will let you know when I do. They purely have to enforce the law and did not make it and they are the most helpful government department I have come across. (Don’t tell the government this because they’ll then probably shut it down!)

What I think they will say is that the right of portability only applies to information an individual has provided to a controller. A photograph has not been supplied by the individual and should therefore be exempt.

Also, the raw data from a camera does include the camera settings, and one could argue that they too are protected as intellectual property. When you export a raw file to a jpeg you can remove this information.

I’ll keep you posted. Thanks again for reading and engaging in my blog.

Proprietary formats would be something like a Lightroom catalog file, which is specific to that piece of software. RAW files can be read by many software products so I’d assume they’re no different to JPG in that regard.

(My JPGs retain the camera settings anyway, but I’m not a professional)

The “adversely affect the rights and freedoms of others” consideration is a far more interesting one, and might be how balance is achieved. I could however easily argue that your processing of my data misrepresents me (i.e. you turned the RAW into a black and white image, and really my skin is lemon chiffon) and I want to use data portability to allow another data processor to create a superior representation.

As you suggest, that then gets interesting around copyright law. Methinks the powers that be just didn’t think this one through, and it’d be useful to get some clarity (and common sense) before a bunch of barristers get rich(er).

Yes, the exemptions are there because of the Human Rights Act, which allows for freedom of expression. This article was written before it was enacted by Parliament before the provision had been finalised.

Your point about sharing raw files is an interesting one. Thinking about it, I am pretty sure you don’t need to share raw files. If you have a photograph of someone, it would be perfectly okay to send a low-quality JPEG that is, if necessary, watermarked. You are just saying ‘I hold this data.’ Why? You have rights accrued from your intellectual works outside of GDPR, namely moral and material rights. They have been enshrined in British Law since 1709.

Regarding potability, the ICO says:
“there may be legitimate reasons why you cannot undertake the transmission. For example, if the transmission would adversely affect the rights and freedoms of others. It is however your responsibility to justify why these reasons are legitimate and why they are not a ‘hindrance’ to the transmission.” For others, read ‘you.’

Being forced to forward raw files would hinder your moral and intellectual rights. I think that would be a legitimate defence against sharing the entire raw file, which would contain your intellectual property, such as the camera settings you used to achieve a particular shot and, (if you use your manufacturer’s software), the embedded adjustments. You can only remove this data by changing it into another file format.

Furthermore, transmission of data must be interoperable, i.e. easily read by other machines. Raw files are not interoperable as they require specialist software to access them. JPEGs or BMP or GIF files are. It is easy to create a low resolution, small format, watermarked copy.

The ICO say “The GDPR does not require you to use open formats internally. Your processing systems may indeed use proprietary formats which individuals may not be able to access if you provide data to them in these formats. In these cases you need to perform some additional processing on the personal data in order to put it into the type of format required by the GDPR.” Raw files would probably be an example of a non-open format.

What is more, you still have copyright law to protect your work. If the subject reuses the images without your consent, then you have the full weight of criminal law to back you up, along with massive fines and prison sentences for the perpetrator.

Again, I reiterate that I am not a lawyer and this is how I am interpreting the law. I’ll speak to the ICO and get this clarified.

What’s far more fun is data access requests and the right to portability. Get ready to share your RAW files..

Hi Dod,

As I have said before, I am not a lawyer. This post is my interpretation of the conversations I have had with the ICO. I can’t give legal advice, but happy to have a discussion.

In most cases, there is no change from pre-GDPR and common sense prevails. So, I think it depends upon what you are doing with the photos; the circumstances in which you use them.

At a concert, I think there is a reasonable assumption that, if photography is allowed, people will appear in the background of photographs. It’s the same as the BBC filming a concert for television. It would be impracticable to get permission from every person.

When I have done work at events for large corporations, they have asked me not to supply ‘close-ups of anonymous people’ but pictures of the entire audience. To me, that seems a common sense approach.

People in audiences tend to appear quite small and unidentifiable in these shots, especially when reproduced in articles.

There are GDPR exemptions under the Human Rights Act which allows for ‘freedom of expression’ and ‘freedom of the press’. So, if you think you could defend (perhaps in court) your work as either art or journalism, you should not have a problem. If you are shooting for magazines, I think that is journalism.

The thing to watch in the future is the changes to the Human Rights Act.