Since May 25, 2018 at the latest, the question has arisen as to whether the new data protection provisions must be observed for a wide variety of digital applications/processes. The new data protection provisions from the European General Data Protection Regulation (GDPR) and the new German Federal Data Protection Act must always be observed when personal data is processed in non-private areas.
Processing of personal data
Photos (and films) may also contain personal data. On the one hand, the facial image is a personal datum, on the other hand, additional data such as location and time of image capture or other GPS information are frequently stored as metadata for the individual digital photos. High-resolution recordings in HD quality often also enable biometric recognition of the persons depicted. These cases are even considered particularly protected sensitive personal data (Art. 9 GDPR).
Legal basis for data processing
Any processing of personal data must be done lawfully, meaning that there must be a legal basis in accordance with Art. 6 GDPR. In this context, however, the legitimate question arises as to what role the German Act on Copyright in Works of the Fine Arts and in Photography (also referred to as the Art Copyright Act "Kunsturhebergesetz") continues to play. Will the Art Copyright Act become meaningless because of the GDPR? Or do the provisions of the Art Copyright Act apply to photographs as the more specific provisions?
The data protection supervisory authority of the state of Brandenburg has now commented on these issues (LDA Brandenburg: "Processing of personal data in case of photographs," available at: https://www.lda.brandenburg.de/media_fast/4055/DSGVOFotografienfinal.pdf). The supervisory authority clarifies that the Art Copyright Act only contains provisions for the distribution and public display of photographs. As far as the actual "photographing" activity is concerned, i.e., the production of the photograph, the Art Copyright Act does not include any provisions. In this respect, the legal basis of the GDPR must always be used, such as consent, contract performance, or legitimate interests.
Legal basis for photography
The legal basis to be considered is therefore consent under data protection law. The problem with this legal basis is, however, that the consenting party has the right to revoke the consent at any time with effect for the future. This may result in the photograph having to be deleted and no longer being permitted to be used. In addition, the GDPR requires detailed information of the data subject for the consent to be effective at all. Under this consideration, a different legal basis should be chosen if one is available.
Taking photographs may also be permitted because the person photographed has concluded a contract with the photographer about the photos. No other persons may be photographed on the basis of this contract, however.
In addition to contract performance and consent, processing (here: photographing) on the basis of overriding legitimate interests may also be considered. In this case, the interests of the parties worthy of protection must be weighed against each other. The interests of the photographer may include the wishes to pursue the professional activity, which is subject to professional or artistic freedom, or the interests of the organizer (as third-party interests) to document an event. These interests are to be weighed against the photographer's interests. The interests of the photographer depend on his or her reasonable expectations. At public or large events, the photographer must expect the event to be documented in photographs. Secret or discrediting photographs, however, will not outweigh the photographer's legitimate interests, so that such photographs predominantly cannot be taken on the basis of legitimate interests. LDA Brandenburg cites further examples, in which the photographer cannot rely on legitimate interests, such as the photographing of children and photos of persons that relate to religion, health, sex life, or the sexual orientation of the person photographed. The latter situations, like biometric data, fall under the special categories of personal data that are particularly worthy of protection under Article 9 GDPR.
Legal basis for the use of photographs
For the use of photographs, such as publishing, the Art Copyright Act could take precedence, however. Section 22 Art Copyright Act stipulates that portraits may only be distributed or publicly displayed with the consent of the person depicted. Section 23 Art Copyright Act governs situations in which, by way of exception, no consent is required, such as relating to photographs of events or if the person is only accidentally ("as an accessory" of a place) included in the photograph. It is currently unclear whether the Art Copyright Act will remain applicable alongside the GDPR.
Article 85(1) and (2) GDPR provide that the Member States must or may provide for exemptions from the GDPR for journalistic, scientific, artistic, and literary purposes to ensure freedom of expression and information. It is unclear whether Germany has so far made such provisions. According to current information, Germany has at least not notified any exception laws to the Commission. The Art Copyright Act may possibly be a legal provision under Art. 85(1) GDPR for which no notification to the Commission is required. Legal uncertainty currently exists in this respect. The Federal Ministry of the Interior, Building and Community has published a statement on this issue (available at: https://www.bmi.bund.de/SharedDocs/faqs/DE/themen/it-digitalpolitik/datenschutz/datenschutzgrundvo-liste.html#f10924666). The independent data protection authorities, on the other hand, have not yet submitted their positions. Nor does LDA Brandenburg position itself with the above-mentioned statement. It merely holds that the use of photographs requires the consent of the person photographed or another legal basis. The exceptional provisions of Section 23 Art Copyright Act could be taken into account at least in the context of a balancing of interests when processing on the basis of justified interests, as long as no provisions to the contrary would be made.
In order to avoid legal uncertainties, it is advisable to obtain consent for the publication of personal photographs, wherever possible.
Exemptions for the press
Exceptions will at least exist for the press, because LDA Brandenburg considers the "media privilege" to still apply. For photography and distribution of photographs for journalistic-editorial purposes, the media privilege, which is governed by Section 9c and Section 52 Interstate Broadcasting Treaty on the one hand, and by various national laws on the other hand, is a provision in accordance with Art. 85(1) GDPR. The press is thus exempt from numerous provisions of the GDPR. It must be ensured, however, that only the journalistic press (e.g., newspapers or photojournalists, possibly also blogs) falls under this exemption. A corporate press department will likely not be able to invoke this exemption.
Since personal data are processed, the information duties under Articles 13, 14 GDPR must be met. The Brandenburg Data Protection Authority recommends privacy policies to be communicated in invitations or on information signs at events. In the case of photographs with a large number of individuals, the provision of information may be disproportionate in individual cases, so that according to Art. 14(5) GDPR, in exceptional cases, no information would have to be provided. This could be conceivable in a public space where people cannot be reached, such as in the subway or in public places. In this respect, however, the individual case must always be considered.
Duties to erase
Personal data, thus also photographs depicting persons, are to be erased as soon as they are no longer required. As long as the data are necessary to enforce legal claims, however, there is no duty to erase them. The German Copyright and Related Rights Act (also referred to as Copyright Act) stipulates how long works enjoy protection. Accordingly, photographs enjoy copyrights 70 years after the death of the author, i.e., the photographer. For this period, there is no obligation to erase the data. Due to the media privilege or other statutory provisions, additional and differing duties to erase data may exist if, for example, there is a historical interest in storage of the photographs.
Personal data are involved where individuals may be identified on photographs. This means that data protection laws must be observed if photographs are not taken and published exclusively in private areas. The GDPR definitely applies to photography. It is currently unclear whether the Art Copyright Act applies primarily to the publication or other use of photographs depicting individuals. It also remains to be seen whether legislation will be passed to add simplifications. In any event, drafts for the revision of the Art Copyright Act that are known to date do not yet offer sufficient solutions to the questions raised above.
As long as the supervisory authorities and courts do not position themselves, it is currently advisable to obtain the consent of the persons photographed, wherever possible, to publish photographs and to rule out legal uncertainties. In any event, information should be provided wherever reasonably possible.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.