Written by Claire Denoual and Claire Leonelli - Avocats à la Cour
Published on 25.09.2018 - Paperjam
The end of summer marks the revival of networking events, many of which are covered by a photographer or even filmed. A few legal precautions are necessary to ensure the proper use of these photos by the organizers.
The rule is simple: every person has the right to decide if he or she wants to be photographed or filmed and to set the limits of the use of these shots. This is what is commonly called the right to image, a right that is simply an attribute of the right to privacy.
In order to talk about the right to an image, a person must be identifiable: by his or her face, of course, but possibly also by a detail that makes him or her recognizable among others (tattoo, particular physiognomy, etc.). This is not the case for a blurred image or a silhouette in a background photo.
As soon as a natural person is identifiable, the taking of his or her image and its dissemination constitute the processing of personal data falling under the scope of the GDPR (again?!). The organizer will have to respect the rights of the persons concerned, and in particular their right to prior information. But how to inform the participants of an event about the processing of their data? The CNPD proposes to include this information on the invitation or via a display on site. A combination of the two seems appropriate, as well as taking advantage of the registration form to provide the required detailed information. The use of these best practices needs to be documented.
Once this point of prior information is settled, the heart of the matter remains, that of the legitimacy of image processing. At first glance, under GDPR, such processing could be justified by the organizer's legitimate interest in keeping internal documentation of its events, without the need to obtain consent. However, this does not take into account the rules set forth by the jurisprudence on image rights, which requires, with some exceptions, consent not only for the taking of photographs but also for the publication of these recordings.
With respect to the taking of photographs, consent may be implied as long as it results from positive behavior. For example, when the subjects of the photograph or film strike a pose. However, consent to the taking of photographs or films does not imply authorization to distribute them. Explicit permission must be obtained in advance, except in rare cases where freedom of expression and information is required. Thus, news events in which a public figure or a "lambda" person participates, but only for the time when this event remains topical or a little later when it will have acquired a historical significance. This is generally where the problem lies: once broadcast on the Internet, the images are generally not deleted after an expiration date (which is not clearly determined either).
What can be done in practice to obtain a valid consent?
In theory, the authorization for the diffusion of the images can be simply oral, but then how to prove that the consent was specifically given for the multiple uses envisaged by the organizer? The written word seems to be invited to the table.
The use of separate checkboxes on the invitation form for example (publication on the organizer's website, publication on social networks, use on brochures, newsletters, etc.) may then seem like a good idea... provided in practice that the person concerned can be identified...
However, very often, the organizer will not know him or her and a fortiori will not recognize him or her.
This is then only the beginning of the Chinese puzzle since the absence of answer to a request for consent is equivalent to a refusal and that the consent given beforehand can be withdrawn at any time... which implies either not to diffuse the photo anymore, or to blur the concerned faces. How to manage these different hypotheses in practice? How to sort the images of people who have consented or withdrawn their consent from the others? In the absence of established practices in this area, the task can be difficult...
Also, in view of this complexity and the risks to which the organizer is exposed (remember, up to 20 million in fines or 4% of the world's turnover in fines, in addition to potential damages), caution is the order of the day.
Except in the (rare) cases where the organizer will be able to manage the consents he will have obtained, we cannot recommend too much to the organizers to limit the use of the photographs taken during the events to their communication operations in direct link with these.
The risk and complexity we have just mentioned are primarily related to the reuse of images for further marketing purposes. It is therefore up to everyone to regularly clean up the photos published on the internet or social networks and to put in place appropriate processes to manage the requests of the people concerned.
The image above is under license CC BY-SA 2.0