Making photos and videos at events

No personal use 

The exception for personal or domestic use of visual material does not apply to you. This exception only applies:

• if there is no connection whatsoever with business or commercial activities;
• you do not publish on behalf of a company or an organisation.

Asking for consent

You are only allowed to make and publish photos and videos in which your visitors, colleagues or pupils/students are clearly recognisable if you have a legal basis for doing so. The GDPR contains 6 legal bases for being allowed to process personal data.

The legal basis that is by far the most obvious when making and publishing visual material is consent. This means that you must have consent from your visitors, colleagues or pupils/students to be permitted to make and publish photos and videos of them.

Besides, your visitors must give their consent with a clear, affirmative action. This action must show that a visitor gives you their well-informed consent for making photos and videos during your event and possibly publishing them.

This action may be an oral or a written declaration. But the consent can also be derived from behaviour. For example, that the visitor enters part of the venue of your event through an access gate or by a route that unmistakably demonstrates that by doing this, the visitor gives consent. A visitor therefore does not necessarily have to give consent in writing.

Note: you must be able to demonstrate that you have properly informed your visitors about the specific processing of their personal data.

Informing visitors

Do you ask your visitors for consent for making photos and videos during your event? Then you have to provide your visitors with the following information:

• the identity of you as an organisation (name and address);
• the purpose of the processing for which you ask consent;
• which personal data you collect and use;
• that your visitors have the right to withdraw their consent.

You must offer the information in an accessible form. The information must also be given in clear and simple language, to ensure that all your visitors can make a well-informed choice.

You can provide the information, for example, by means of an information sign at the entrance and/or the ticket sales of your event.

Asking for consent is not possible

Are you unable to ask for consent? Then you may be able to rely on the legal basis of legitimate interest. However, there will not be a legitimate interest very often. You can only rely on this legal basis if you meet the requirements.

Withdrawing consent

If visitors want to withdraw their consent, this must be just as easy as giving consent. You can, for example, place a button at photos or videos on your website with the text: ‘Are you in this photo or video and do you not want this? Click here.’

Does a visitor withdraw the consent? Then you have to blur the image of that visitor in the photos and videos that you publish. Or remove the photos of that person from your publications and destroy them. Note that this applies not only for your website, but also for your own photo archive.

Are you unable to obtain consent?

You are not allowed to put someone under pressure to give consent. Nor are you allowed to disadvantage someone who does not give consent.

You can solve this by, for example, partitioning your room or event venue. In some places you will make photos and/or videos, in other places you will not do this.  You can also, for example, blur the images of visitors who do not want to be photographed.

Note: the alternative option for people who do not want to be in photos or videos must be equivalent to what you offer the people who do give consent for this purpose.

Special categories of personal data

Data about, for example, someone's health, religion, race/ethnicity, sexual orientation and political preference are given extra protection by the law because of their sensitive nature. We call these data special categories of personal data.

There are situations in which special categories of personal data are processed by making and publishing photos and videos. For example:

• A restaurant that aims to employ people with a mental or physical disability, which photographs or films these people for a promotional campaign to attract new staff.
• A teacher who makes photos of a meeting where children are at prayer and shares these photos on the school website.
• An organiser who wants to promote a religious event among believers with the help of photographic material in which people are clearly recognisable.

You are only allowed to process special categories of personal data if you can rely on one of the exceptions to the prohibition of processing these data. And additionally have a legal basis from the GDPR for your processing.

If all of the following 3 requirements apply, you process ordinary – and therefore no special categories of – personal data with your photos and videos:

• The photos or videos are not aimed at special categories of personal data or making a distinction based on these data.
• Nor can you reasonably foresee that someone will make a distinction based on your photos or videos.
• The processing of the special categories of personal data is unavoidable when making a photo or video. For example, when you film someone who wears glasses or a headscarf. This could say something about someone's visual health or religious conviction. But filming someone without those glasses or headscarf is not or hardly a realistic option.

A facebook on the intranet of the employer, a school photo, or the promotion of a (general) event usually involves ordinary personal data.