GDPR explained and vacation photo hacks to deal with it

In recent weeks you've likely received dozens of updated privacy notices. They're due to the implementation of the European Union's (EU) General Data Protection Regulation (GDPR). It went into effect on May 25. For some time to come, we'll be learning how far it reaches into daily life.

GDPR was written to strengthen European citizen's privacy rights and stop abuses by social media enterprises and other businesses who collect personal data and share it, often without the knowledge of users and customers.

Unfortunately, GDPR seems to have some unintended consequences.

Vacation photography is a staple of travel. Today, more photos than ever are made by travelers of all kinds. In the 21st century, travelers whip out their cellphones to photograph everything and anything they see. Sometimes, within seconds of making them, their photos are posted online for all to see.

If travelers' photos made in EU nations contain recognizable people, the GDPR privacy law can cause them problems.

So, what is the GDPR?

The new law was primarily enacted to stop businesses from misusing personal data collected from Europeans. It requires explicit consent for data collection and the specific uses for which the data is to be employed. It's requirements are meant to keep individuals' personal data from getting into the wrong hands, in order to prevent people from abuse through their personal data's use. It was also written to permit EU citizens to end or modify the collection of their personal data, should they desire.

Beyond obtaining explicit consent, GDPR requires organizations and individuals who collect, use, process, maintain and store individuals' personal data to keep records that show they have consent, how it's protected and for how long it's maintained. Failure to follow GDPR leads to fines which can be significant.

Consent can be written or oral, but if it's oral, it's important that it's well documented.

In addition GDPR requires businesses to make a notification of any data breach within 72 hours of the breach, rather than the weeks and months or longer that some businesses have taken.

Personal data that falls under GDPR includes name and contact information, as well as other personally identifiable information about individuals. More precisely, personal data is any information that could be used to identify an individual.

Personal data also includes one's likeness. Therefore, photographers and vacationers who make photographs while in Europe fall under GDPR. Of special consideration is when images are posted to social media for general public viewing.

Under GDPR, EU nations may enact exemptions for “freedom of expression and information.” It is expected that these will be legislated for areas of journalism, literature and the arts, but to date, GDPR is so new that countries are still considering what they should do.

GDPR allows anyone who appears in a photograph taken in the EU, who is identifiable the right to refuse to be in the photo. It is the photographer's responsibility to determine whether or not subjects want to be in the photo.

If you gain the consent of those who are identifiable in your photographs, you'll have no problem, however, the consent must be “informed” according to GDPR. In other words, individuals in your photos must fully understand what use you plan for the photographs. If you plan to post them on social media, you must ask them if they consent to that use.

Getting consent can be problematic and cumbersome. For example, more often than not what makes great street photographs is that the image of people is not posed. Typically, a candid shot is preferred to a posed image. The GDPR wants you to ask for consent in advance which can destroy the photographic opportunity for the image. In addition, under GDPR, consent can be withdrawn at any time.

For photographs of landmarks, obtaining consent can make the image difficult to capture too. Most of the time, famous landmarks are teeming with visitors, many wishing to photograph the landmark at the same time as you. If the landmark is small and the faces of visitors numerous, waiting until everyone steps aside may be not be possible. Obtaining permission from all can be difficult too.

Even selfies often have extraneous people in the background who may be recognizable. Almost by definition, selfies are made to post on social media.

So, how can vacationers continue to make photographs of their travels in Europe?

GDPR wasn't created to catch and fine vacationers. Taking into account how other people feel who accidentally become subjects in your photographs will generally keep most vacationers in good shape.

When I've made photographs in markets, at landmarks and other locations, I've normally asked permission to photograph them in advance. When I didn't speak their language, I motioned with my hands. Vacationers can do the same. Vacationers can also wait for quiet times to make photographs. If necessary you can blur some faces.

GDPR may dangerously impact European journalism, literature and the arts unless EU member nations act quickly to ensure their integrity isn't compromised.

While the photographic thirsts of vacationers are not terribly impacted by GDPR, I believe that a more measured latitude for their photos should be permitted. Far more important, however, is that GDPR must not be allowed to diminish European journalism, literature and the arts. Hopefully, the EU member nations will understand the importance of making reasonable exemptions to ensure GDPR doesn't squash European “freedom of expression and information.”

(Please note that the author of this article, Ned S. Levi is not an attorney and that nothing in this article should be considered legal advice.)