In Part 2 of this sequence, we observe which restrictions concerning the use of images are posed by the EU General Data Protection Regulation, or GDPR.
Fundamentally, Art. 6(1) GDPR states that processing personal data (under which images of a person may be subsumed) requires either the consent of the other party or must be necessary for the performance of a contract, for complying with a lawful obligation, for protecting the vital interests of an individual, for fulfilling a task in the public interests, or for realizing any other legitimate interests.
Consent in the sense of Art. 6(1) letter a GDPR demands voluntary submission to a specific use of data (principle of specificity). Furthermore, Art. 7(4) clarifies that the giving of consent may not be tied to the conclusion of a contract, unless necessary for the fulfilment of the contract. According to Art. 7(3) GDPR, the person concerned has the right to withdraw their consent.
As far as the necessity for the performance of a contract as per Art. 6(1) letter b is concerned, it has to be absolutely necessary as far as the contractual relationship is concerned. Necessity for the puerposes of legitimate interests pursued by the controller or a third party in the sense of Art. 6(1) letter f, meanwhile, carries with it a balancing act between third party interests and the image owner’s rights.
Even where one of the conditions of Art. 6(1) GDPR is fulfilled, processing has to conform to general principles according to Art. 5 GDPR. These include fairness and transparency, accuracy, integrity and confidentiality, accountability, limiting the processing to its initial purpose, minimising the data affected, as well as limiting storage.
Whenever photography involves special technical means which render the data generated as biometric, or where photography reveals racial or ethnic origin, stricter rules apply according to s. 26(3) BDSG and Art. 9 GDPR.
