General Data Protection Regulations (GDPR)
Photographs (and videos) of identifiable people are considered Personal Data and are therefore subject to data protection laws and specifically the General Data Protection Regulations (GDPR) that came into force on May 25th 2018.
Data Processing and Data Controlling
When Sam Lane Photography (SLP) is commissioned to photograph a project on behalf of a third party SLP is considered a third party Data Processor and the Data Controller is the person or entity commissioning the project. If SLP is taking photos for our own marketing use we are both the Data Controller as well as the Data Processor.
Lawful Basis for Processing
SLP operates under the following lawful bases for processing depending on the Client:
Consent is the principle lawful basis for processing when undertaking a project on behalf of a Client. This would cover most types of commercial work including head shots, events, PR and editorial.
• SLP has a template for consent forms which can be tailored to the Client and also administers Client-generated forms as required.
- Legitimate Interests
SLP considers Legitimate Interests as a lawful basis for processing in relation to large social events such as weddings and situations when you can reasonably expect photography to be taking place and where photography has a minimal privacy impact.
• SLP always operates in lawful way and takes personal privacy very seriously.
SLP uses Contract as a lawful basis for processing for projects where agreements are made by individuals eg for portraits or engagement shoots. Contracts may be simple email correspondence agreeing to the photography proposal.
Taking photos/capturing footage “Images”
When we are commissioned to capture images we receive a brief from the Client and agree our approach with taking photos. We will always operate in a professional and lawful manner and respectful of our Clients’ wishes. The following key principles apply:
- The people we are photographing should be aware we are taking photos – agreed in writing with the Client before the project. This can also be mentioned in any pre-project communication and on signage on the day.
- Verbal communication/consent is agreed with the Team Leader/event organiser/commissioning person to take photos before photos are taken. This conversation will include details of the Client (Who we are taking photos for); potential usage of the photos (How they may be used eg for social media, PR, website); and how they can access more information (about privacy, usage, rights)
- Written consent is obtained with any identifiable people before photos are taken. This signed, dated, co-branded form is then photographed and the hard copy left with the Subject. The photograph is stored in the gallery with the images from the project, although it is hidden and not shared outside of SLP. It is for record only.
SLP stores photos online on a password-protected website in a series of folders and galleries. This site is owned and managed by Smugmug which is a US-based company.
Processed photographs are also backed up on portable Hard Disk Drives stored securely in the homes of the Photographer(s) who processed the images.
We store images for at least seven years.
- SLP does not access or use the images, the image are simply archived and available as a back up for Clients.
- SLP has no control over how the images/footage is stored by the Client.
Links to the galleries are shared with the Client and links are also made available if the Client wishes or needs to share the galleries with third parties (agencies etc).
- SLP does not share galleries without written permission from the Client.
When commissioned by a Client for a project SLP processes the images but does not use photos without express written permission from the Client for use as testimonials or social media.
- SLP does not control how a Client uses the photos.
The Smugmug website is an e-commerce website where Clients can buy digital or printed copies of the images.
- SLP does not directly sell images commissioned by a Client.
- SLP does not control if/when/how a Client sells the images.
You have a number of rights in relation to the images of you:
- The right to be informed
SLP provides individuals with information including: our purposes for processing your personal data, our retention periods for that personal data, and who it will be shared with. This is called Privacy Information. This must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.
- The right of access
You have the right to access your personal data. This is commonly referred to as Subject Access. You can make a subject access request verbally or in writing. We have one month to respond to a request and we cannot charge a fee to deal with a request in most circumstances.
- The right to rectification
The GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete. You can make a request for rectification verbally or in writing. We have one calendar month to respond to a request. In certain circumstances we can refuse a request for rectification.
- The right to erasure / ‘the right to be forgotten’.
You can make a request for erasure verbally or in writing. SLP has one month to respond to a request. Reasons can include:
• the personal data is no longer necessary for the purpose which we originally collected or processed it for.
• SLP is relying on consent as your lawful basis for holding the data, and the individual withdraws their consent.
• we are relying on legitimate interests as our basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing.
• we are processing the personal data for direct marketing purposes and the individual objects to that processing.
- The right to restrict processing
You have the right to restrict the processing of your personal data where you have a particular reason for wanting the restriction. This may be because you have issues with the content of the information we hold or how we have processed your data.
- The right to data portability
This allows individuals to obtain and reuse their personal data for their own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.
- The right to object
The GDPR gives you the right to object to the processing of your personal data in certain circumstances. You have an absolute right to stop your data being used for direct marketing. In other cases where the right to object applies we may be able to continue processing if we can show that we have a compelling reason for doing so. SLP must tell you about your right to object and you can make an objection verbally or in writing. We have one calendar month to respond to an objection.
- Rights in relation to automated decision making and profiling
We do not feel that Photography and Videography undertaken by SLP is subject to this right. None of our processes are automated.
Contacting the Data Protection Officer, Processor and Controller
The Data Protection Officer, Data Processor and Data Controller for SLP is Samantha Lane, founder of samlane Limited.
Clients of SLP are subject to their own Data Controllers and Data Protection Officers and SLP will facilitate access to these individuals if relating to SLP Data Processing.
Any questions arising from direct or indirect Processing of your Data should be addressed to firstname.lastname@example.org or in writing to the registered office at:
71a Cambridge Road
Last updated 10th January 2020