Street Photography in the EU

[Ilkka Nissilä]

Then there is data protection, which is related but not the same as privacy.  You have a right to control the collection and use of personal data, and, obviously, a photograph of your face is personal data.  So, EU law is that people cannot publish photographs of you - use your personal data - without your consent, and cannot take photographs of you - collect your personal data - if you object.

I don't think a street photograph of a person qualifies as personal data (in the sense meant in the GDPR) unless you tag it with identifying information about the person so it can be easily searched and is stored in a database. Facial recognition has been suggested as permitting identification of people from photos but I don't think it will work well when you have billions of potential subjects to identify. It might work well when you have a database of criminals or suspects to search and identify in photographs, but when doing an open unlimited search to identify anyone, and everyone, I doubt it would be able to have much success. Street photographs often aren't showing persons in close-ups and they are often technically modest in quality, which reduces the likelihood of positive identification. Also the purpose of storing the images matters. If it is to identify people participating in a demonstration and target those individuals in some campaign -  the GDPR  is likely to apply. But street photos are not generally made for the purposes of identifying people or gathering information about them; they're made for personal enjoyment and artistic purposes. This excludes them from GDPR. Publication is another matter but it is a separate issue.

In the EU, individual countries have their own laws, and French law's interpretation of privacy or the rights of the subject may not be the same as another country's.

[Les Olson]

Individual EU countries have their own law, but all those laws have to conform to the European Convention on Human Rights as interpreted by the European Court of Human Rights.  Where they don't it is because no one from that country has yet taken a case to the ECHR, so courts in that country are free to interpret their country's law as written. Once a citizen of that country has taken a case to the ECHR the courts are obliged by the EU treaties to decide subsequent cases according to the decisions of the ECHR. 

The GDPR, on the other hand, is a regulation, rather than a directive, so it applies in its entirety, throughout the EU, immediately, with no action by member states required.

A street photograph is personal data.  The GDPR website says that personal data is "Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address" [emphasis added] (https://www.eugdpr.org/gdpr-faqs.html). So it only isn't personal data if the person is not recognisable.  However, the GDPR "does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity." (s18).  (Natural persons are people, as opposed to "legal persons" such as corporations or partnerships). 

[Ilkka Nissilä]

https://www.hipaajournal.com/gdpr-exemptions/

"A number of other exemptions are provided for in Articles 85, 86, 87, 88, 89, 90, and 91. Article 85, for example, Processing and freedom of expression and information,establishes the right for member states to introduce laws which balance the rights to privacy of personal data with the rights to freedom of expression for “journalistic […] and […] academic, artistic or literary expression”."

So member states can introduce laws which strike a balance between the rights of freedom of expression and privacy of personal data. This would then depend on the country.

Although the UK is leaving the EU (at least for the time being it would seem so), the UK government's position is to implement GDPR.

RPS website discuss the implications on street photography:

http://www.rps.org/special-interest-groups/contemporary/blogs/2018/february/gdpr-and-street-photography

in the comments section:

"
Ivor
01 March 2018

hi, I have communicated with the ICO about this. they say:

"The GDPR allows member states to introduce exemptions/derogations. These will be set out in the Data Protection Bill - it's likely there will be a similar exemption for personal data processed for the purposes of "journalism, literature and art" but as the Bill has not yet been approved and adopted by Parliament, we can't yet confirm what those exemptions will be.

In relation to street portraits of individuals; these will not be 'biometric' data. ""

I don't think we can say at this point how these regulations will be implemented in practice and how it differs depending on country.

Even if it were decided to take a strict position in favour of privacy, it would be impossible to extend the regulation to everyday photographs of people on the street. Every day as I walk in downtown area of Helsinki, I can see people taking pictures of people on the streets using their mobile phones, cameras etc. and they do it and I know some of those photos will be put on social media sites. No one seems to object to this activity these days it seems it has become such commonplace. 10-20 years ago this was not the case and a street photographer would easily be confronted because the activity was somewhat unusual. Now it is so common there is literally nothing that can be done to stop it more than you can prevent rain drops from falling out of the sky.

I'm certain that the intention of the GDPR is not to prevent this common, everyday activity from happening.

I just read about GDPR on the Finnish data protection official's (I don't know how to translate it) web site and although GDPR starts to be in effect on May 25 throughout the EU, member states will be issuing national legislation which augments and makes more specific rules regarding the EU regulation. There seem to be some freedom for the member nations to make their own more specific legislation, as usual. Only after these national laws are in effect will there be some clarity regarding to how these things are to be interpreted, and I would guess this to take some time.

Excemptions mentioned in the Finnish site include "journalistic, artistic and literary expression and a natural person's private use". They specifically mention publication of photos in a blog that can be interpreted as a journalistic purpose (excemption).  I think street photography published as art is likely to be considered under the "artistic" excemption, however, of course these things can be questioned by the identifiable person in the photograph and then there may be court cases but I think given the prolificacy of photographs of people published online without consent I don't think this will be a common thing to happen, unless the photos in question show the person in negative light or is used in an advertisement without consent (in which case a person's right to their image applies and compensation would be likely). While the French seem to intepret the person's right to their image to apply also outside of commercial use, it doesn't appear to be the prevailing interpretation in my country.

The data protection official's overall conclusion is that photography needs to be evaluated using the whole legislation not just using an individual piece of it, this includes data protection of personal data, freedom of speech, criminal law, the guidelines of journalism, contractual obligations, and other applicable legislation. In Finland the freedom of speech is protected by the constitution.

[Ron Scubadiver]

US law is moving quite rapidly to the same destination as EU law, although by a different route: copyright and personal image rights.  You will, relatively soon if things go on as they have been, have what amounts to copyright in your image, just as celebrities do now, so people will not be able to create "derivative works" - photographs of you - without your consent.  There is no Constitutional impediment to that.  Americans are fond of saying that "there is no expectation of privacy in a public place".  This is not a correct statement of US law: there is an expectation of privacy in public places that are set up to offer some degree of privacy - a public toilet being the obvious example.  A more fundamental point is that the statement that there is no expectation of privacy in a public place is based on court decisions about the 4th Amendment prohibition of unreasonable search and seizure.  There is no Constitutional right to reasonable search and seizure, so nothing prevents the law saying there is an expectation of privacy in public.  It is well-established that the 1st Amendment does not protect breaches of copyright.

I thought personal image rights only applied to commercial use.  In other words, use in advertising.  Copyright protection seems far fetched.  Can you provide a link to an appeals court decision supporting any of this?

[Les Olson]

You can read the full English text at https://gdpr-info.eu/

The wording of s85 is that "For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions [...] if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information."  The key point is that it says "if they are necessary" [emphasis added].  Each country gets to decide for itself if they are necessary, and you might find that Victor Orban, say, has a different view to you and me about how much and what kind of freedom of expression is necessary. There is a "recital" linked to that section - ie, a non-binding comment - that says "In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly", so the intention is that there will be a broad-based exemption, but it is up to each country. 

"Biometric data" is defined as data that allows a person to be uniquely identified.  Biometric data is only a subset of "special data", meaning sensitive information for which extra protection is warranted.  Photographs "should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person" [emphasis added]. However, another subset of special data is "personal data revealing racial or ethnic origin", so photographs could fall under that category.

[Les Olson]

I thought personal image rights only applied to commercial use.  In other words, use in advertising. 

As of today, that is correct.  But why should there be that restriction?  The reason to mention copyright is that the language of personal image rights law is very similar to copyright law, which makes it very easy for courts to see a way to extend image rights because copyright law is so well-defined. 

[Ilkka Nissilä]

the intention is that there will be a broad-based exemption, but it is up to each country. 

Yes. But it is likely that those countries who had such exemptions in the past will have them in the future as well. In general, nations in the EU tend to want to preserve their own cultures and individual ways and change as little as possible upon legislation issued by the EU.  The clear focus of this legislation is to take a step back into a world before companies started to collect massive amounts of data on us.  It is not intended to limit the journalism or arts. I believe the intention of the legislators is important as it is likely that the actual application of the law follows the intention.

Of course, if the government or the people of a member country want to side on stronger protections on the individual then they can continue to implement such national legislation. If it turns out that they went with too strict rules  then they can change it and take a step back at a later time. I haven't been in France in a long time and I don't know if the people there really believe that a photograph of a stranger on the street published violates the rights of that person but in Helsinki the people on the street just generally laugh about it and I can't recall in many years any negative incident with this activity. But I think it would be a mistake to assume that it is the same everywhere. I can see how taking of a photograph would be considered invasive in some cultures. In such cases it is best to respect the wishes of the subjects.

I do believe that the social media and large companies got far too much information and power - they offered a "free" service in a time when we were used to having to pay for almost every service provided by a private company. Now we know what the price of that "free" service is (to the point where elected governments can be changed in part thanks to the use of such data to find the people who are likely to be persuaded to change their vote) and there has to be a step back. I am delighted if the spamming and targeted advertising one day stops.

"Biometric data" is defined as data that allows a person to be uniquely identified.  Biometric data is only a subset of "special data", meaning sensitive information for which extra protection is warranted.  Photographs "should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person" [emphasis added]. However, another subset of special data is "personal data revealing racial or ethnic origin", so photographs could fall under that category.

I think the intention of collection of the data and how it is used is key. If the purpose is to identify the persons in the photos and record their activities then this would be considered personal data and governed by the legislation. However, if it is just artistic application without identification algorithms used then I don't think it would be considered biometric or personal data. Now, then if one goes and publishes the images and then someone else downloads them and applies facial recognition software then I would think the latter would need the permission of the subjects. As for whether the publication of the images of strangers without permission is legal, would depend on the country's specific legislation.  I know in my country publication of amateur street photos of strangers on photographers' social media sites has been ok in the past, but I don't know if this is changing (especially if the images do not fall under the "artistic" or "journalistic" umbrellas). I suspect not, because of the popularity of this activity and how people seem to accept that being photographed just happens a lot of the time when walking in public. I think the camera phone made this happen - more people walk with cameras in their pockets and they also understand the motivation of photography better and don't regard there any harm.

[Ron Scubadiver]

Les, I find your explanation of the exception provision in EU law to be very helpful, but on US law I disagree.  Freedom of speech is such a bedrock principle in the US that it makes restrictions of photography really difficult.  In particular, a Texas statute dealing with voyeuristic photography was struck down by the State courts, which almost never invalidate state criminal statutes.

The problem with exceptions is it takes action on the part of legislative bodies.  Perhaps the press will be the constituency which seeks change and with luck the exception will be broad.  As it stands right now the situation is dire because the aggrieved person does not have to hire a lawyer.  They can go to the data protection agency for relief.

I continue to believe there will be an uproar as ordinary folks in the EU find themselves locked out of all kinds of internet resources. 

[Danulon]

I continue to believe there will be an uproar as ordinary folks in the EU find themselves locked out of all kinds of internet resources.

On the short run certainly. On the long run other companies will be eager to fill the gap.

[Ron Scubadiver]

On the short run certainly. On the long run other companies will be eager to fill the gap.

Others will jump in, but the resulting experience will be inferior to what exists now.

[Frank Fremerey]

shoot, publish, delete fast when asked by a right holder.

there are billions of smartphones with cameras and people "publishing" shots by the billion a day. Try stopping the rain by sueing a drop?

PS: Nikongear is not a publishing platform. Nikongear is friends and family sharing their photos, look at the number of views per picture!!!

If necessary Admins could easily not show any photos to non paying members.

[Airy]

Agreed. And (as experience shows) the problem rather lies with possible reactions while shooting, from people not knowing the law, rather than the publication itself, to which the law applies.

[Frank Fremerey]

Agreed. And (as experience shows) the problem rather lies with possible reactions while shooting, from people not knowing the law, rather than the publication itself, to which the law applies.

I tell the that I am allowed to take any picture but I am not allowed to publish every picture.

And: It is more often people ask me for my address because they want my picture for their private use...

More annouying are property rights. Half the banks of the river Thamse in London are private ground and the owners police their right to make you not take any photos. Also the backdrop of "copyrighted" buildings in the public space can make publishing difficult. I hate that much more.

All property has originally been a rob from the public goods except for creative original work that can be attributed to a person

[Ilkka Nissilä]

I continue to believe there will be an uproar as ordinary folks in the EU find themselves locked out of all kinds of internet resources.

I don't believe that. I don't want to use services that do data mining of my e-mails or use cookies to track my activities on my computer and associate those with my personal data. I don't want any company to present a service and in fact do something undisclosed in the background. If they do that, they are at the very least unethical and hopefully legislation will consider those activities criminal in the future.

If a company providing a service is open about why they need my data and how it is used, there should not be a problem with GDPR compliance. Anyway in the US probably they will have some similar legislation in the future.

[armando_m]

I don't believe that. I don't want to use services that do data mining of my e-mails or use cookies to track my activities on my computer and associate those with my personal data. I don't want any company to present a service and in fact do something undisclosed in the background. If they do that, they are at the very least unethical and hopefully legislation will consider those activities criminal in the future.

If a company providing a service is open about why they need my data and how it is used, there should not be a problem with GDPR compliance. Anyway in the US probably they will have some similar legislation in the future.

Right, and that is what GDPR is all about