Event photography and GDPR: consent or legitimate interests?