Not only website operators who process personal data are forced to act by the General Data Protection Regulation (GDPR), which came into force on May 25, 2018. Photographers and their works are also directly affected by the GDPR. You can no longer exclusively refer to the Art Copyright Act (KUG). Now the GDPR deadline is just 6 weeks old and as is so often the case with new legal regulations, the situation is not 100 percent clear – until court decisions confirm it in one direction or the other. In this article we give an overview of the status quo regarding the GDPR for photographers.
Why the works of photographers are covered by the GDPR
A bit of legal theory to get you started: As a professional photographer, you have probably already wondered why your works are now governed by two legal bases. In addition to the Art Copyright Act (KUG), which has been in force since 1907 and which largely clarifies the copyright claims on photographic works (photos & videos), the General Data Protection Regulation (GDPR) came into force across the EU on May 25th, 2018.
In addition to the KUG, it regulates whether your works contain personal data and how you as a photographer have to deal with it. So where you previously made do with a KUG-compliant model release contract to obtain permission to remarket the photos, you now also have to observe additional data protection guidelines.
Above all, people photography is affected by the GDPR. Let’s say you are photographing a street artist in the pedestrian zone. Now the crucial question arises: Is the person you photographed identifiable through their picture? Does your picture also contain other personal characteristics such as race, origin, religious orientation or membership in a club, association or party?
According to the GDPR, it is already sufficient if the face and/or personal characteristics of the subject are clearly recognizable. The ordinance assumes: The identity of the person, eg the name, can be determined (with more or less great effort) via the information from the picture.
Decisive for which law the photo falls under is also the intended use. If the recording is a snapshot with the smartphone that you only want to show to friends and acquaintances, the KUG (so-called “household exception”) applies. As a professional photographer, however, this situation will probably very rarely apply. Instead, you want to make money from your images. It does not matter whether this happens in an indirect or direct way.
For example, if you put the photographed street performer on your website as a reference, you are considered to be doing so for profit. After all, you want to use your photos to encourage potential customers to place orders. The commercial intention is just as clear if you sell the image to image portals such as Getty Images, Shutterstock and Co. or if you find a direct buyer in the form of an advertising agency or a company.
How to obtain GDPR-compliant consent from your models
Let’s stay with the street artist who was photographed for a moment. You proceed in a legally correct manner by addressing your model and agreeing on a so-called model release with him. Curiously, since the introduction of the GDPR, this no longer has to be done in writing, but it is advisable to avoid possible disputes with the model. In a standard model release, however, it is only regulated that the model’s copyrights are transferred to the photographer – depending on the agreement without time and media-specific restrictions.
So far, data protection has generally been left out of these agreements. Now you have to explicitly explain to your model that you are storing personal data through the photo, namely on the storage medium of your digital camera. Professional photographers also enrich their digital prints with meta information, e.g. when and where the picture was taken, and it is not uncommon for photographers to give their pictures their own names directly. All of this is stored in EXIF and/or IPTC files.
All this privacy-related information must be part of the model release. Will you later export your images to a cloud platform like Google Drive or Dropbox? Then you should also include this information in the agreement with your photo subject. Because in case of doubt, your model has the right to have personal data that you have stored deleted. Actually a legal contradiction, as it turns out in practice. Because theoretically, a model could prohibit the further use of an image, even though it has contractually surrendered the copyright to it.
The reasoning: The picture contains personal data that can identify the model and according to the GDPR every consumer has the right to take action against it. Whether the KUG is placed above the provisions of the GDPR – and thus avoids this dilemma – depends on the courts. This example clearly shows that the GDPR cannot and does not want to clearly regulate many practical areas of application.
Speaking of cloud services: If, as mentioned above, you save your photo files on external servers, you must conclude a contract with the cloud provider as of May 25th, 2018, which clearly regulates how personal data is handled. Not only do your customers expect discreet, GDPR-compliant handling of your images, you as a professional photographer also want to prevent your photos from being illegally distributed by third parties.
In most cases, you were informed by the cloud provider before the GDPR came into force and you have already agreed to a new data protection contract. The major cloud providers also provide comprehensive information about the challenges of the GDPR. Dropbox, for example, has set up a GDPR Guidance Center for this purpose.
Journalists are exempt from many GDPR guidelines through media privilege
If you work as a press photographer or photojournalist, many of the rules of the GDPR do not apply to you. Carrying out your work carries an important responsibility: you document events relevant to contemporary history and protect freedom of the press and freedom of expression with your photos.
In concrete terms, this means that you do not have to obtain explicit consent to applicable data protection law from every person you photograph. In case of doubt, however, you should definitely be able to prove that your image material is being used for journalistic or editorial purposes.
(Photo) bloggers also fall under this media privilege, provided they address the public with their photos and make a contribution to freedom of expression. Influencers who generate income via Instagram with photos are expressly not taken into account by the media privilege. If, on the other hand, an Amnesty International photographer blogs about the ongoing refugee crisis and, in the process, photographs asylum seekers on a boat, a clear journalistic intention can be recognized.
Quick check: Which photographers are subject to the GDPR
As a photographer, you are likely to fall under the General Data Protection Regulation if you
- take commercial photos, e.g. for advertising purposes by companies, at weddings or at public events
- Are photo artists (requirement: commercial intentions)
- Are bloggers or influencers, your work is not to be considered journalistic and you are pursuing a profit-making intention
- take photos on behalf of authorities
- work on behalf of a PR department of a company if they are not journalists (applies to the vast majority of PR departments)
The GDPR does not apply to you (and instead the KUG) if you
- Are a photojournalist or press photographer and protect freedom of expression and freedom of the press with your work
- take analog photos and the developed images are not enriched with personal data in a file
- only use the pictures taken for private purposes and share them with family or friends
- Take photos of the dead, as the person can no longer be harmed by the misuse of the personal data
Conclusion: With the GDPR, new rules apply to people photography
For photographers who regularly have models in front of their lenses, the GDPR has turned the legal situation almost 180 degrees. While before May 25, 2018 only the regulations of the Art Copyright Act (KUG) were applicable, the tightening of the GDPR now applies. In concrete terms, this means that even taking photos in which people can be identified via personal characteristics is prohibited as long as there is no express consent to the subject. In legal terms, this is called the “permission standard”.
For comparison: before 25.05. was that no permit standard for the recording of the picture had to exist, only the (commercial) further distribution was regulated under the KUG. Photographers should therefore first and foremost have a legally watertight model release contract in their pocket that contains all data protection-related information. Photographers who are members of the Federal Association of Professional Image Providers (BVPA) can download model release forms in the members’ area. Non-members receive the documents for a flat rate of 350 euros net.
By the way: Don’t forget that as a photographer you must also comply with the GDPR regulations applicable to websites if you store personal data, e.g. via a contact form.
