Event photography and GDPR: consent or legitimate interests?

Photos help show the atmosphere of an event, capture special moments and give people a better understanding of an organisation’s culture. However, taking, storing and publishing photos of identifiable people is personal data processing. This is easy to overlook.

It can be especially difficult when an organisation needs to collect and document people’s consent for different uses of photos or different publication channels.

A sign saying “Photography is taking place at this event” is not enough.

Before using the photos, the organiser must decide why the photos are needed, where they will be published and which legal basis applies.

Start with the purpose

The organisation should be clear about how the photos will be used. For example:

• to report on the event on the organisation’s website;
• to publish content on social media;
• to prepare reports for partners or funders;
• to use the photos in the organisation’s communication or marketing materials.

Taking a photo and publishing a photo are not the same thing. The organisation should assess separately whether and how the photos may be published on its website, social media, in advertising materials or through other channels.

The clearer the purpose and publication channels are, the easier it is to choose the right legal basis and explain the processing to attendees.

Consent or legitimate interests?

The Latvian Data State Inspectorate identifies consent and the organiser’s legitimate interests as two possible legal bases for events held by companies.

An organisation should not choose the legal basis simply because one option seems easier. It should consider the purpose of the photography, whether the processing is necessary, how the photos will be used and how the processing may affect people’s privacy.

If an organisation relies on consent, people must understand exactly what they are agreeing to. For example, consent to publish an image on the organisation’s website does not necessarily mean consent to use it in an advertising campaign.

The DVI states that a legitimate interests balancing test must be completed before processing based on legitimate interests begins. The organisation should be able to explain its interest, why the processing is necessary and how it assessed the impact on people’s rights.

When relying on consent, the organisation must be able to prove that valid consent was obtained. The DVI provides further guidance on consent as a legal basis.

Neither legal basis automatically allows an organisation to publish every photo taken at an event. The assessment depends on the specific situation, the content of the image and how the image will be used.

Other legal bases may apply in different situations. This comparison focuses on events organised by companies.

The legal basis should be assessed for the specific purpose and channel. An organisation should not assume that one legal basis automatically covers every use of an image.

A Sign Is Not Consent

The DVI clearly states that an organisation should not claim that buying a ticket or attending an event automatically means that a person agrees to being photographed or to the publication of their image.

Buying a ticket or entering the event venue is not consent by itself.

An information sign tells attendees that photography is taking place. It does not replace consent or create consent by default.

If consent is required for a specific use of a photo, it must be collected properly.

People must understand exactly what they are agreeing to, such as publication on the organisation’s website, a specific social media account or in advertising materials.

Inform People Before Photography Begins

The information should be available before the event or at the venue, before photography or filming starts.

Attendees should be able to understand:

• who is responsible for processing their personal data;
• why photos or videos are being taken;
• which legal basis is being used;
• where the photos and videos may be published;
• who may receive the materials;
• how long the materials will be kept;
• how to object to the use of their image or withdraw consent;
• how to request the removal of a specific photo;
• how to contact the organisation or submit a complaint.

If the organisation is asking for consent, attendees should also be told how they can give, change or withdraw their consent.

The full information can be included in the organisation’s privacy notice. A shorter version can appear at ticket sales points, on tickets and at the event entrance.

The shorter information should also include a clear way to access the full privacy notice.

Make Objections and Withdrawals Easy

Before the event, decide where and how attendees can object to the use of their image, withdraw consent or request the removal of a specific photo.

The process should be practical. The organisation should provide a contact person or email address, explain how to submit a request and state what information is needed to identify the relevant image.

Each request must be considered according to the legal basis being used. The person should receive a response without undue delay and normally within one month.

A request should not be ignored simply because the photo has already been published on a website or social media. People who want to manage their own images can find more in the for individuals section.

If the image has been published through several channels controlled by the organisation, the organisation should consider how to remove it or stop using it in all relevant channels.

Set Clear Rules with Photographers

If an external photographer or company works on behalf of the organiser, both parties should agree on:

• the purpose of the photography;
• how the materials may be used;
• who may access the photos and videos;
• how the materials will be stored and transferred;
• each party’s data protection responsibilities;
• what to do if a person objects to the use of their image or withdraws consent.

If the photographer processes the images on behalf of the organiser and follows the organiser’s instructions, the organisation should assess whether the photographer is acting as a data processor. If so, the parties should sign an appropriate data processing agreement.

Photographers should also know what to do when someone says that they do not want to be photographed.

A Quick Check Before the Event

Before the event, make sure that:

• the purpose and publication channels have been defined;
• the legal basis has been chosen and documented;
• a retention period has been set;
• attendees will receive the necessary information;
• information signs are ready;
• there is a process for objections and consent withdrawals;
• a contact person or contact address has been appointed for requests;
• clear data processing terms have been agreed with photographers;
• the organisation can document who gave consent, when consent was given and which use of the image was approved.

Responsible use of event photos requires more than putting a sign at the entrance. It requires a clear process that allows the organisation to explain its decisions, inform people and respect their choices.

An information sign tells people that photography is taking place, but it does not help the organisation prove or manage consent. See how the process works in practice.

If an organisation uses consent or relies on legitimate interests for the use of event photos, MyFaceGuard helps manage the process in one place - send and document consent requests, receive people’s responses, record consent withdrawals, manage objections and keep a clear history of consents, objections and decisions. The platform helps organisations keep track of the processing purpose, the legal basis used, the information provided and the actions taken, without relying only on emails, spreadsheets or manually created records.

MyFaceGuard for businesses helps organisations review previous actions and maintain clear data processing documentation. This supports the organisation’s ability to explain its decisions and manage the use of event photos responsibly.

MyFaceGuard does not replace a legal assessment and does not decide which legal basis an organisation should use. The platform helps organisations manage and document processes both when consent is used and when processing is based on legitimate interests. The identity of the person giving consent can be confirmed with secure identity verification methods.

Learn more about MyFaceGuard · See pricing

Sources

• Practical guidance for event organisers: photography and filming
• Practical guidance for event organisers: photography, filming and publication
• Legitimate interests and the balancing test
• Choosing the correct legal basis: consent
• General Data Protection Regulation

This article is not legal advice. For a specific situation, consult a lawyer or data protection professional.