The purpose of the General Data Protection Regulation is to protect individuals' fundamental rights and freedoms, particularly their right to protection of their personal data. Images in which you can identify a person are deemed by GDPR to be personal data and therefore must comply with the same procedures as those that apply to other personal data.
But what does this actually entail? Lawyer Cecilia Torelm Tornberg receives many questions from both companies and the public sector, and she understands the confusion since there is still a lack of precedent. Despite this, we will attempt to answer some of the questions today.
About Cecilia Torelm Tornberg
Cecilia Torelm Tornberg is a lawyer and partner of the MarLaw law firm. MarLaw specializes in marketing law and intellectual property law, as well as issues pertaining to processing of personal data within the private and public sectors. Cecilia is a popular speaker at Berghs School of Communication in Sweden, as well as at various universities, organizations and companies.
Cecilia, what are the most important questions related to GDPR that you hear?
Many people wonder who bears responsibility, especially if you purchase images from stock agencies, image banks or photographers. Another question is whether the depicted individuals need to give their consent.
Starting with the questions concerning consent, when is consent required from a person who is depicted in an image or a video. Does consent have to be in writing, or how should it be documented?
For images and videos to be published, you must comply with GDPR. If anyone in the image can be identified, the person who is visible in the image must give his or her consent.
It must subsequently be possible to produce proof of consent, either in writing or with a video recording of consent being given, for example. What many people forget in this situation is that you also have to inform the individual whose personal data you are processing about how the data will be stored, etc.
It is also important to remember that consent can be revoked. If the depicted person revokes his or her consent, the image must be removed.
Sometimes it might be more appropriate to use a model contract instead of obtaining consent. A contract cannot be revoked in the same way as consent. The model contract can specify in which mediums the images may be used, in which geographic market and during which period.
you need to consider when hiring a photographer for an assignment?
Make sure there is a contract in place that ensures the images can be used in the desired manner in the future; in other words, that the depicted person has signed a contract specifying in which mediums the images may be used, in which geographic market and during which period.
What do buyers need to consider when purchasing images from a stock agency? The exact same conditions apply. You must have signed a contract with the stock agency, and the stock agency must have a signed a contract with the model.
Johnér's images comply with GDPR
You can rest assured when purchasing images from Johnér. Our contracts with photographers and all of the people depicted in our images comply with GDPR.
There are services available that allow you to download images free of charge. What do you need to consider when using this type of service?
It is important to read the terms and conditions regarding how the images may be used. It is also important to remember that it is never possible to sign away legal liability. This means you could be sued later on by a photographer who claims that the image was not transferred to the subcontractor in the manner specified in the service's terms and conditions.
Also avoid images depicting people if it is difficult to know whether there is a GDPR-compliant contract in place with the people who are visible in the image.
Some stock agencies say that their photographers are responsible for signing a contract with the models. Is that sufficient? No, that is not enough. The same conditions apply here. It is not possible to sign away legal
liability. Anyone who publishes images that were illicitly used from the beginning may be guilty of copyright infringement, regardless of any contract that may have been signed.
For example, imagine that an advertising agency produces some printed material on behalf of a municipality and uses images that lack a valid model contract. In this case, both the advertising agency and the municipality are legally liable.
Do you have any final advice to our readers on what they should consider?
Remember that GDPR applies to all processing, including images that you may have purchased, received or used prior to May 25, 2018. You might need to get rid of images that you do not have the right to use.
Advertising agencies in particular should ensure that subcontractor contracts from creators correspond with service contracts, to ensure that no more rights have been granted or transferred than have actually been
Answers to the questions are by no means recommendations for individuals. For additional questions on GDPR, please contact Cecilia Torelm Tornberg, MarLaw.