GDPR - Article 85 guidance is currently being written

[myotis]

Sorry for starting a new thread, but I didn't want this to get lost.

As suggested in the last thread I contacted the Informations Commissioners Office (ICO) to ask for clarification about the implications for street photography from the DATA Protection Bill 2018.

The answer I got back wasn't very encouraging:

"If an image is taken with the intent to record, learn or decide something about the individual captured then this would fall within the scope of the GDPR. Such images could include taking a close up of an interesting individual's face, or a study of the way an individual is dressed or moves. In such cases photographer would need to consider their legal obligations under the GDPR, such as determining their Lawful Basis for processing the data and protecting the rights of the individuals captured. "

There was another paragraph in the email that said that if you included people in a photograph but where the intent was to photograph a landscape or building, and the people were incidental to the picture, this would not be covered by GDPR.

There was no mention in the email about how the UK had transposed article 85 from the Regulations into UK Bill, which is what I had expected them to tell me about.

Anyway, I wasn't happy with this response (which I thought was wrong) and have just come off an hour long phone call with with the case officer for my enquiry, who during the phone call consulted with the ICO legal team (who had apparently specified the content of the email I had been sent).

Several things came from this:

Article 85 in the EU Regulation has been transposed into Schedule 2 (part 5) of the Data Protection Bill 2008 (see the end)

And of of course there is a provision that exempts photographs of people for personal use from being personal data under the bill, including uploading to social media. Facebook and instagram were mentioned, but I can't find where this is actually written down..

BUT there seemed to be a bit of grey area here if you were uploading to a personal "photography" website as to whether this fell within the bounds of publication to "social" media. Which brings us to Schedule 2 (part 5), where I "think" we concluded that if you could demonstrate artistic "intent" (given the arguments over what is and isn't art) and the photographs had not ben used for anything beyond the special purposes listed in schedule 2 (part 5), then the derogation would apply, and you could not be prosecuted under the Bill.

The ICO are currently writing guidance on the Article 85 implementation in the UK Data Protection Bill, but with no timetable.

However, I do seem to be back where I started, in thinking that in spite of many of things I have read in blogs and forum posts, nothing much seems to have changed as a result of GDPR.

The important components are the "personal use" including social media and the exemptions based on article 85.

Several other things were discussed, but these are the key points and a quote that "it is absolutely not the intention of the Bill to stop people taking street photographs" . Or something like that, I didn't get it written quickly enough.

But I await the publication of the guidance, with a slight concern that the email they sent me was lifted directly from the yet to be published guidance.

Probably not necessary, but just to emphasise that this is just my interpretation of the legislation, guidance and the conversion I had with the ICO case officer (who is not part of the ICO legal team) so use my comments cautiously!!



Link to the Bill http://www.legislation.gov.uk/ukpga/2018/12/schedule/2

Exemptions etc based on Article 85(2) for reasons of freedom of expression and information
Journalistic, academic, artistic and literary purposes
26(1)In this paragraph, “the special purposes” means one or more of the following—

(a)the purposes of journalism;

(b)academic purposes;

(c)artistic purposes;

(d)literary purposes.

(2)Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—

(a)the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and

(b)the controller reasonably believes that the publication of the material would be in the public interest.

(3)The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.

(4)In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.

(5)In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.

(6)The codes of practice and guidelines are—

(a)BBC Editorial Guidelines;

(b)Ofcom Broadcasting Code;

(c)Editors' Code of Practice.

(7)The Secretary of State may by regulations amend the list in sub-paragraph (6).

(8)Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.

(9)For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the GDPR)—

(a)in Chapter II of the GDPR (principles)—

(i)Article 5(1)(a) to (e) (principles relating to processing);

(ii)Article 6 (lawfulness);

(iii)Article 7 (conditions for consent);

(iv)Article 8(1) and (2) (child's consent);

(v)Article 9 (processing of special categories of data);

(vi)Article 10 (data relating to criminal convictions etc);

(vii)Article 11(2) (processing not requiring identification);

(b)in Chapter III of the GDPR (rights of the data subject)—

(i)Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii)Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii)Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv)Article 16 (right to rectification);

(v)Article 17(1) and (2) (right to erasure);

(vi)Article 18(1)(a), (b) and (d) (restriction of processing);

(vii)Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii)Article 20(1) and (2) (right to data portability);

(ix)Article 21(1) (objections to processing);

(c)in Chapter IV of the GDPR (controller and processor)—

(i)Article 34(1) and (4) (communication of personal data breach to the data subject);

(ii)Article 36 (requirement for controller to consult Commissioner prior to high risk processing);

(d)in Chapter V of the GDPR (transfers of data to third countries etc), Article 44 (general principles for transfers);

(e)in Chapter VII of the GDPR (co-operation and consistency)—

(i)Articles 60 to 62 (co-operation);

(ii)Articles 63 to 67 (consistency).

 

[Nostromo]

I don't take much street type of photography personally, but after reading yours and various other posts on the subject of GDRP, I think I am more confused now than I was before.
Taking a photo of a landscape, historical building etc that has incidental people in seems to be quite a simple concept to understand. Would a photo of a busy market place or street vendors constitute incidental people? I would say unlikely, as the whole concept of the photo is the people. Would it be art? Some might say yes, others no. It seems to come down to what is art.

 

[myotis]

Would it be art? Some might say yes, others no. It seems to come down to what is art.

I think I covered that by saying if the "intent" is artistic, and although I don't mention it, under the guidance of what is an offence it says that the commissioner needs to be satisfied that the data is not being used for nothing other than is described in Article 85.

If its any consolation the legal team writing the guidance say they are also finding it a very grey area.

Essentially, as I said, I don't think anything has changed, in terms of street photography: while in a public place, a persons face is public, with the same legal protection for the subject as they have always had. There is however additional protection for an individual when it comes to organised "data collection" as part of some structured process. e.g. police photographing and collating photographs of people attending a protest.

 

[ecoleman]

Just go out and take photos. This will never be enforced. It’s just not possible.

I really feel for our kids and grand kids. There will be nothing to look back on. No photos of kids playing, no history, f*** all.

 

[myotis]

Just go out and take photos. This will never be enforced. It’s just not possible.

Well, as my post suggests, my understanding is that there isn't anything to enforce.

However, if the police get it into their heads that its now illegal to take street photographs of people, they may well try and stop you taking them.