Abstract
The General Data Protection Regulation has fundamentally altered the legal environment within which photography is practised across the European Union. By classifying photographs of identifiable individuals as personal data, the Regulation subjects photographic activity to a comprehensive regime of data protection obligations that sits uneasily alongside the intellectual property rights of photographers and the broader public interest in artistic and journalistic expression. This article critically examines the intersection of data protection law and photographic intellectual property, analysing the tensions that arise at three critical junctures: the classification of photographs as personal data and the consequent applicability of the GDPR's processing requirements; the barriers that the consent mechanism and other lawful bases for processing create for street, documentary, and press photography; and the challenge posed by the right to erasure to the preservation and commercial exploitation of photographic works. Through detailed analysis of the jurisprudence of the Court of Justice of the European Union, including the landmark decisions in Ryneš, Planet49, Google Spain, and Google v CNIL, and of national court decisions including the Oberlandesgericht Köln case on artistic expression, the article demonstrates that the current framework produces significant legal uncertainty for photographers, publishers, and digital platforms. It argues that Article 85 of the GDPR, which requires Member States to reconcile data protection with freedom of expression and information, has been implemented inconsistently across the Union, creating a fragmented regulatory landscape that undermines both privacy protection and photographic freedom. The article concludes by proposing a harmonised interpretive framework for the application of the GDPR to photographic practices, grounded in proportionality principles and informed by the specific characteristics of photographic art, journalism, and documentary work.
Keywords: GDPR; photography; personal data; privacy; intellectual property; consent; right to erasure; Article 85; street photography; data protection; artistic expression; freedom of expression
1. Introduction
Photography has occupied an ambiguous position within the legal order since the invention of the daguerreotype in the nineteenth century.1 The capacity of the photographic image to capture and reproduce the likeness of identifiable individuals places it at the intersection of multiple legal regimes: intellectual property law, which protects the creative expression of the photographer; privacy law, which protects the personality rights and informational autonomy of the photographic subject; and, since the entry into force of the General Data Protection Regulation in May 2018, data protection law, which regulates the processing of personal data.2
The GDPR's impact on photography has been profound and, in many respects, inadequately anticipated. The Regulation's expansive definition of personal data, its stringent requirements for lawful processing, and the powerful rights it confers upon data subjects, including the right to erasure, have created a legal environment in which many forms of photographic practice that were previously unregulated or lightly regulated now fall within the scope of a comprehensive compliance regime.3 Street photographers, photojournalists, documentary filmmakers, event photographers, and fine art practitioners must all navigate a regulatory framework that was designed primarily with commercial data processing in mind, not with the distinctive characteristics of visual art and visual journalism.
The tensions between data protection and photographic practice are not merely theoretical. Photographers across the European Union have reported uncertainty about the legality of photographing individuals in public spaces, the conditions under which consent must be obtained, and the circumstances in which a data subject's erasure request must be honoured even where the photograph in question is a protected work of intellectual property.4 These uncertainties have practical consequences: they may produce a chilling effect on photographic expression, inhibit the documentation of public events and social conditions, and create compliance burdens that are disproportionate to the privacy risks posed by many forms of photographic activity.
This article examines these tensions through three analytical lenses. Section 2 analyses the classification of photographs as personal data under the GDPR, drawing upon the CJEU's jurisprudence and the Article 29 Working Party's guidance. Section 3 examines the lawful bases for processing available to photographers, with particular attention to consent, legitimate interests, and the journalistic and artistic exemptions. Section 4 analyses the right to erasure and its implications for the preservation, exhibition, and commercial exploitation of photographic works. Section 5 examines the role of Article 85 and the inconsistent national implementations that have produced a fragmented regulatory landscape. Section 6 proposes a harmonised interpretive framework. Section 7 concludes.
2. Photographs as Personal Data: Classification and Scope
2.1 The GDPR's Definition of Personal Data
Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable natural person.5 An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.6 Recital 26 clarifies that the determination of identifiability should take into account all means reasonably likely to be used to identify the natural person, including singling out.7
A photograph of an identifiable individual constitutes personal data within the meaning of Article 4(1). The image captures the physical appearance of the subject, one of the factors specific to the physical identity of a natural person. Where the photograph depicts facial features with sufficient clarity to permit identification, whether by human recognition or by automated facial recognition technology, the image processes personal data. Recital 51 of the GDPR expressly acknowledges this by stating that photographs should not systematically be considered as processing special categories of personal data, as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification of a natural person.8
This distinction is important. A photograph is personal data whenever it depicts an identifiable individual. It becomes biometric data, and thus a special category of personal data subject to the heightened protections of Article 9, only when it is processed through technical means (such as facial recognition software) for the purpose of uniquely identifying a natural person.9 The vast majority of photographic activity does not involve such processing and therefore falls under the general data protection regime rather than the special category regime.
2.2 The Household Exemption and the Ryneš Decision
Article 2(2)(c) of the GDPR exempts from its scope the processing of personal data by a natural person in the course of a purely personal or household activity.10 This exemption is of obvious relevance to amateur photography: family snapshots, holiday photographs, and similar images taken for purely personal purposes fall outside the GDPR's scope.
However, the CJEU's decision in Ryneš significantly narrowed the scope of the household exemption in the context of visual surveillance.11 Mr Ryneš had installed a camera system on his family home to protect it from vandalism. The camera captured images of the public pavement and the entrance to the house opposite. The Czech data protection authority found that the camera system processed personal data in breach of data protection law, and the matter was referred to the CJEU.
The Court held that video surveillance covering a public space, even partially, cannot be regarded as an activity which is carried out in the course of purely personal or household activities.12 The household exemption, the Court observed, must be interpreted strictly. It applies only to processing that is carried out in a purely personal or domestic context, and the moment the surveillance extends beyond the private sphere of the person operating the camera system, the exemption ceases to apply.
The implications for photography are significant. A photographer who takes photographs in a public space is, by definition, engaging in an activity that extends beyond the purely personal or household sphere. Even an amateur photographer who takes photographs of a street scene for personal enjoyment is processing personal data to the extent that identifiable individuals are captured in the image. The household exemption will not apply unless the photographs are taken and used in a strictly private context, such as photographing family members in a private garden, and are never published, shared on social media, or otherwise made available to a wider audience.13
Kraljić and Ünver have observed that the Ryneš decision effectively subjects all photography in public spaces to the GDPR's requirements, regardless of the photographer's purpose or the scale of the data processing involved.14 This is a sweeping consequence that sits uncomfortably with the longstanding cultural and artistic tradition of street photography, a tradition that has produced some of the most significant works of photographic art in the twentieth and twenty-first centuries.
2.3 The Scope of Processing
Belov and Belikov have noted that the GDPR's definition of processing is exceptionally broad, encompassing any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction.15 The act of taking a photograph of an identifiable individual constitutes collection and recording. Storing the image on a memory card, hard drive, or cloud service constitutes storage. Editing the image (cropping, adjusting exposure, applying filters) constitutes adaptation or alteration. Publishing the image on a website, social media platform, or in print constitutes disclosure by transmission and dissemination. Each of these operations is a distinct processing activity within the meaning of the GDPR, and each requires a lawful basis under Article 6.16
This comprehensive scope means that the GDPR applies not only to the moment of image capture but to the entire lifecycle of a photograph: from the pressing of the shutter button, through storage, editing, selection, and curation, to publication, exhibition, sale, licensing, and eventual deletion. For professional photographers, this creates a complex compliance landscape in which each stage of the photographic workflow may engage different data protection obligations.
3. Lawful Bases for Photographic Processing
3.1 The Consent Framework
Article 6(1)(a) of the GDPR provides that processing is lawful where the data subject has given consent to the processing of his or her personal data for one or more specific purposes.17 Article 4(11) defines consent as any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.18
The consent requirement, as interpreted by the CJEU, is demanding. In Planet49, the Court held that consent must be a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of the data subject's agreement, and that a pre-ticked checkbox does not satisfy this requirement.19 The implication for photography is that valid consent to the processing of photographic personal data cannot be implied from the data subject's mere presence in a public space, from a general notice posted at the entrance to an event, or from the data subject's failure to object when the photographer raises the camera.
For studio portraiture, wedding photography, and other commissioned photographic work, consent is relatively straightforward to obtain. The photographer can present the subject with a written consent form that specifies the purposes of the processing (portfolio use, social media publication, print sales), the categories of data processed (photographic images depicting the subject's physical appearance), the duration of processing, and the data subject's rights. Model release forms, long used in commercial photography, can be adapted to satisfy the GDPR's consent requirements provided they meet the standards of specificity, granularity, and clarity that the Regulation demands.20
For street photography, photojournalism, and documentary work, consent is practically impossible. A street photographer who wishes to capture a candid image of a stranger in a public square cannot, by definition, obtain prior consent without destroying the spontaneity that is the essence of the genre.21 A photojournalist documenting a public protest cannot reasonably obtain informed consent from every identifiable individual in a crowd of thousands. The consent mechanism, designed for the bilateral relationship between a data controller and a data subject in the context of commercial data processing, is ill-suited to the multilateral, spontaneous, and often anonymous character of much photographic practice.
3.2 Legitimate Interests
Article 6(1)(f) provides that processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.22 This provision requires a three-part balancing test: the identification of a legitimate interest pursued by the controller; an assessment of the necessity of the processing for that interest; and a balancing of the controller's interest against the data subject's rights and freedoms.
For photographers, legitimate interests may include: the creation of artistic works expressing the photographer's creative vision; the documentation of matters of public interest (news events, social conditions, cultural practices); the creation of a professional portfolio for the purposes of securing commercial work; and the commercial exploitation of photographic images through licensing, print sales, and exhibition.
The balancing exercise is inherently fact-specific. Relevant factors include the reasonable expectations of the data subject (a person attending a public event may reasonably expect to be photographed, whilst a person entering a medical clinic may not); the nature of the personal data (an image of a person's face in a public square is less intrusive than an image of a person in a vulnerable or compromising situation); the potential impact of the processing on the data subject (publication in a national newspaper carries different implications from inclusion in a personal portfolio); and the safeguards adopted by the controller (anonymisation, pixelation of faces, contextual framing).23
The legitimate interests basis offers a more workable foundation for street and documentary photography than consent, but it remains subject to significant uncertainty. The outcome of the balancing test cannot be determined in advance with any precision, and the photographer bears the burden of demonstrating that the balance favours processing. This creates a compliance risk that may deter photographic activity, particularly among photographers who lack the resources to obtain legal advice on a case-by-case basis.
3.3 The Journalistic Exemption and Article 85
Article 85(1) of the GDPR requires Member States to reconcile by law the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic, or literary expression.24 Article 85(2) permits Member States to provide exemptions or derogations from key provisions of the GDPR, including the principles relating to processing (Chapter II), the rights of the data subject (Chapter III), the obligations of the controller and processor (Chapter IV), and the restrictions on international transfers (Chapter V), where processing is carried out for journalistic purposes or for the purposes of academic, artistic, or literary expression, and such exemptions or derogations are necessary to reconcile data protection with freedom of expression.25
Article 85 is of critical importance to photography. It provides the legal basis upon which Member States may exempt photojournalism, documentary photography, and fine art photography from the most burdensome requirements of the GDPR, including the consent requirement, the right to erasure, and the data minimisation principle. Without Article 85 derogations, the GDPR's application to photography would be so restrictive as to be incompatible with the right to freedom of expression guaranteed by Article 11 of the Charter of Fundamental Rights of the European Union and Article 10 of the European Convention on Human Rights.26
However, the implementation of Article 85 has been markedly inconsistent across Member States. Some Member States, such as Germany, have adopted broad exemptions for journalistic and artistic processing that provide substantial protection for photographic practice.27 The Kunsturhebergesetz (KUG), Germany's pre-existing right to one's own image statute, continues to apply alongside the GDPR and provides a nuanced framework for balancing the photographer's artistic freedom against the subject's personality rights, distinguishing between persons of contemporary history (whose images may generally be published without consent) and ordinary private individuals (whose consent is generally required).28
Other Member States have adopted narrow exemptions that offer limited protection. The result is a fragmented regulatory landscape in which a photograph that is lawfully published in one Member State may be unlawful in another, depending on the scope of that state's Article 85 derogation. This fragmentation undermines the GDPR's objective of harmonisation and creates practical difficulties for photographers, publishers, and platforms that operate across borders.
3.4 The OLG Köln Decision
The decision of the Oberlandesgericht (Higher Regional Court) Köln illustrates the application of the Article 85 framework in practice.29 The case concerned a photographer who had taken photographs of individuals in a public setting and published them as part of an artistic project. The subjects of the photographs objected to the publication and sought an order for the removal of the images on data protection grounds.
The OLG Köln held that the photographer's artistic freedom, protected by the German Basic Law and the EU Charter, must be balanced against the data subjects' right to informational self-determination.30 The Court applied a proportionality analysis, considering the artistic purpose of the photographs, the degree of intrusion into the subjects' private sphere, the public or private character of the setting, and the extent to which the subjects were identifiable. The Court concluded that the artistic exemption applied and that the photographer was entitled to publish the images.
The OLG Köln decision provides a model for the proportionality-based approach to balancing photographic freedom with data protection. However, it is a decision of a German appellate court and has no binding authority in other Member States. The absence of CJEU guidance on the application of Article 85 to photography leaves the law in a state of uncertainty that only a harmonised interpretive framework can resolve.
4. The Right to Erasure and Photographic Works
4.1 Article 17 and the Right to be Forgotten
Article 17(1) of the GDPR grants data subjects the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of several grounds applies.31 These grounds include the withdrawal of consent, the objection to processing on legitimate interests grounds, and the circumstance that the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.32
The right to erasure is of particular significance for photography. A data subject who is depicted in a published photograph may, under certain circumstances, request the deletion of that image. For the photographer, compliance with such a request may entail the destruction of a work of intellectual property: a creative expression in which the photographer holds copyright, which may form part of the photographer's portfolio, and which may have been exhibited, published, or licensed to third parties.
The tension between the right to erasure and the photographer's intellectual property rights is acute. The GDPR does not provide an express exception to the right to erasure for the protection of intellectual property. Article 17(3) provides that the right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, or for the establishment, exercise, or defence of legal claims.33 Of these exceptions, the most relevant to photography are the freedom of expression exception and the archiving exception.
4.2 Google Spain and the Contextual Assessment
The CJEU's landmark decision in Google Spain v AEPD and Mario Costeja González established that the right to be forgotten, as it was then conceptualised under the Data Protection Directive, requires a contextual assessment that balances the data subject's privacy rights against the public interest in access to information.34 The Court held that the data subject's right to privacy will, as a rule, override the interest of the general public in having access to the information, but that the balance may be struck differently where, for particular reasons, such as the role played by the data subject in public life, the interference with the data subject's fundamental rights is justified by the preponderant interest of the general public in having access to the information in question.35
In Google v CNIL, the CJEU addressed the territorial scope of the right to be forgotten, holding that EU law does not require a search engine operator to dereference on all versions of its search engine globally, but that it must dereference on all Member State versions of the search engine and take measures to discourage internet users within the Union from accessing the delisted results on non-EU versions.36
These decisions establish the framework within which the right to erasure operates in the context of online publication. For photographers who publish their work on websites, social media platforms, or stock photography agencies, the implications are significant. A data subject who requests the erasure of a published photograph may simultaneously seek the delisting of that image from search engine results, effectively removing it from public view across the European Union.
4.3 Practical Obstacles and the Kronenberg Analysis
Kronenberg has identified several practical obstacles to the effective exercise of the right to erasure in the photographic context.37 First, the photographer may not be the only party in possession of the image. Photographs published online are routinely cached, indexed, and copied by search engines, social media platforms, content aggregators, and individual users. Even if the photographer deletes the original image, copies may persist across the internet indefinitely. Second, the photographer may not be able to identify all the channels through which the image has been disseminated, particularly where it has been shared on social media or republished by third parties. Third, the right to erasure may conflict with the photographer's contractual obligations to licensees, publishers, or platforms that have acquired rights in the image.38
These practical obstacles do not relieve the photographer of the obligation to comply with a valid erasure request. Article 17(2) requires the controller who has made the personal data public to take reasonable steps, having regard to available technology and the cost of implementation, to inform other controllers which are processing the personal data that the data subject has requested erasure.39 The photographer must therefore not only delete the image from their own systems but also notify downstream recipients of the erasure request.
4.4 The Intellectual Property Dimension
The intersection of the right to erasure with intellectual property rights raises questions that the GDPR does not explicitly address. A photograph in which an individual is identifiable is simultaneously personal data (from the perspective of the data subject) and a work of authorship (from the perspective of the photographer). The photographer's copyright in the image, which arises automatically upon creation under Article 2(1) of the Berne Convention and the relevant national copyright legislation, entitles the photographer to control the reproduction, distribution, communication to the public, and adaptation of the work.40
When a data subject exercises the right to erasure in respect of a photograph, the effect may be to extinguish or severely curtail the photographer's ability to exploit the copyright in the work. If the photographer must delete the only copy of the image, the copyright becomes worthless. If the photographer must refrain from publishing or exhibiting the image, the right of communication to the public is effectively nullified.
The GDPR provides no mechanism for compensating the photographer for this loss. Nor does it provide a general intellectual property exception to the right to erasure. The freedom of expression exception in Article 17(3)(a) may apply where the photograph serves a journalistic or artistic purpose, but its scope depends on the Member State's implementation of Article 85, and the photographer bears the burden of demonstrating its applicability.41
Schäfer has argued that the GDPR's failure to address the intersection of data protection and intellectual property creates a hierarchy in which data protection rights effectively trump intellectual property rights, without any explicit legislative mandate for that hierarchy.42 This criticism has force. The GDPR's drafters appear to have given insufficient consideration to the circumstances in which the exercise of data protection rights may conflict with the legitimate intellectual property interests of data controllers.
5. The Fragmented Landscape: National Implementation of Article 85
5.1 Divergent Approaches
Article 85(2) of the GDPR requires Member States to provide exemptions or derogations for processing carried out for journalistic purposes or the purposes of academic, artistic, or literary expression, where such exemptions are necessary to reconcile data protection with freedom of expression.43 The discretion afforded to Member States in the implementation of this provision has produced a markedly heterogeneous regulatory landscape.
Germany, as noted above, has adopted a comprehensive approach through the interaction of the GDPR, the Federal Data Protection Act (Bundesdatenschutzgesetz), and the Kunsturhebergesetz, providing a layered framework that distinguishes between journalistic, artistic, and commercial photography and applies graduated levels of data protection based on the nature of the photographic activity and the status of the data subject.44
France has implemented Article 85 through provisions in the Loi Informatique et Libertés that provide exemptions for journalistic processing but offer less explicit protection for artistic and documentary photography than the German framework.45 The French approach relies more heavily on the general proportionality analysis under the legitimate interests basis, creating uncertainty for photographers who cannot easily predict the outcome of the balancing exercise.
Other Member States have adopted minimal implementations that merely repeat the language of Article 85 without providing the detailed derogations that the provision contemplates.46 In these jurisdictions, photographers must rely on the general provisions of the GDPR, including the legitimate interests basis and the general principles of proportionality and necessity, without the benefit of specific exemptions tailored to the characteristics of photographic practice.
5.2 Consequences of Fragmentation
The fragmentation of the Article 85 landscape has several consequences. First, it creates legal uncertainty for photographers, publishers, and platforms that operate across borders. A photograph lawfully published in Germany under the KUG framework may be unlawful in a Member State that has adopted a narrower exemption. A photographic agency that licenses images across the Union must navigate 27 different regulatory regimes, each with its own exemptions, conditions, and enforcement practices.47
Second, it undermines the GDPR's objective of establishing a consistent level of data protection across the Union. The Regulation's architects intended that the directly applicable nature of the instrument would eliminate the regulatory divergences that characterised the Data Protection Directive. Article 85, by delegating the reconciliation of data protection and freedom of expression to Member States, reintroduces precisely the kind of divergence that the GDPR was designed to overcome.
Third, it creates forum-shopping incentives. Data subjects may seek to enforce their rights in jurisdictions with narrow Article 85 derogations, whilst photographers and publishers may seek to establish themselves in jurisdictions with broad derogations. This dynamic is contrary to the level playing field that the GDPR's harmonisation objective is intended to achieve.
5.3 The Need for CJEU Guidance
The inconsistency of national approaches to Article 85 calls for guidance from the Court of Justice of the European Union. To date, the CJEU has not directly addressed the application of the GDPR to photography or the interpretation of Article 85 in the photographic context. The Court's general jurisprudence on the balancing of data protection with freedom of expression, developed in the context of search engine delisting and media publication, provides useful principles but does not address the specific characteristics of photographic practice: the instantaneous nature of image capture, the impossibility of prior consent in many photographic contexts, the artistic and documentary value of images depicting public life, and the intersection of data protection rights with the photographer's intellectual property.48
A preliminary reference from a national court on the application of Article 85 to photography would provide the CJEU with the opportunity to establish harmonised principles for the reconciliation of data protection and photographic freedom. Such guidance would benefit photographers, data subjects, national data protection authorities, and national courts alike.
6. Towards a Harmonised Interpretive Framework
6.1 Principles for Reform
The analysis in the preceding sections demonstrates that the GDPR's application to photography produces significant tensions and uncertainties. The classification of all photographs of identifiable individuals as personal data subjects a vast range of photographic activity to a comprehensive compliance regime. The consent mechanism is ill-suited to street, documentary, and press photography. The right to erasure may require the destruction of works of intellectual property. And the fragmented implementation of Article 85 creates a patchwork of national exemptions that undermines legal certainty and cross-border photographic practice.
A harmonised interpretive framework should be guided by the following principles.
First, proportionality. The application of the GDPR to photography should be proportionate to the privacy risks posed by the specific photographic activity. A photograph of a crowd at a public festival poses minimal privacy risks compared to a close-up portrait of a vulnerable individual in a private setting. The regulatory burden imposed on the photographer should reflect this difference.49
Second, contextual assessment. The lawfulness of photographic processing should be assessed in context, taking into account the purpose of the photography (journalistic, artistic, documentary, commercial, personal), the setting (public space, private space, semi-public space), the status of the data subject (public figure, ordinary individual, vulnerable person), the degree of identifiability (clear facial image, distant or obscured figure), and the manner of publication (personal portfolio, social media, national press, commercial stock agency).50
Third, recognition of the photographer's intellectual property. The GDPR should not be interpreted as creating an implicit hierarchy in which data protection rights automatically override intellectual property rights. The photographer's copyright in a photographic work is a property right protected by Article 17(2) of the Charter of Fundamental Rights of the European Union and by Article 1 of Protocol No 1 to the European Convention on Human Rights. Any interference with that right must be justified and proportionate.51
Fourth, harmonisation of Article 85 derogations. The European Commission should issue guidance, or the CJEU should establish principles, for the consistent implementation of Article 85 across Member States. At minimum, the derogations for journalistic and artistic processing should be interpreted consistently to provide a uniform level of protection for photographic freedom across the Union.52
6.2 Specific Proposals
Building upon these principles, this article proposes three specific reforms.
A sector-specific code of conduct. Article 40 of the GDPR encourages the drawing up of codes of conduct intended to contribute to the proper application of the Regulation, taking account of the specific features of the various processing sectors.53 A code of conduct for the photography sector, developed in collaboration with professional photography associations, data protection authorities, and civil society organisations, could provide practical guidance on the application of the GDPR to different forms of photographic activity. Such a code could clarify the circumstances in which the legitimate interests basis applies, provide template model release forms and privacy notices, establish best practices for the anonymisation and secure storage of photographic personal data, and set out procedures for responding to data subject access and erasure requests.
An express intellectual property exception to the right to erasure. Article 17(3) should be amended, or authoritatively interpreted, to include an express exception for circumstances in which the erasure of personal data would result in the destruction of a work of intellectual property in which the data controller holds copyright or related rights. This exception should be subject to a proportionality analysis that weighs the data subject's privacy interests against the photographer's intellectual property interests and the public interest in the preservation of photographic works.54
European Data Protection Board guidance on photography. The European Data Protection Board should issue guidelines on the application of the GDPR to photography, addressing the classification of photographs as personal data, the applicable lawful bases for different forms of photographic activity, the application of the right to erasure to published photographic works, and the interpretation of the Article 85 derogations. Such guidelines would promote consistent application across Member States and reduce the legal uncertainty that currently characterises this area of law.55
7. Conclusion
The GDPR's application to photography illustrates a broader tension in contemporary data protection law: the difficulty of applying a general regulatory framework, designed primarily for the processing of personal data in commercial and governmental contexts, to activities that engage fundamental rights on both sides of the equation. The photographer's right to freedom of expression and the data subject's right to privacy are both protected by the Charter of Fundamental Rights and the European Convention on Human Rights. The challenge is to reconcile these rights in a manner that is proportionate, context-sensitive, and respectful of the specific characteristics of photographic practice.
The current framework falls short of this standard. The consent mechanism is unworkable for many forms of photography. The right to erasure may require the destruction of protected intellectual property. The fragmented implementation of Article 85 has created a patchwork of national exemptions that undermines legal certainty and cross-border practice. Photographers, particularly those engaged in street photography, documentary work, and photojournalism, operate in a legal environment characterised by uncertainty, compliance risk, and the possibility of chilling effects on legitimate expression.
The reforms proposed in this article, a sector-specific code of conduct, an express intellectual property exception to the right to erasure, and European Data Protection Board guidance on photography, would go some way towards addressing these deficiencies. However, the most fundamental step is the development, whether by the CJEU or through legislative action, of a harmonised interpretive framework that recognises the distinctive characteristics of photography and provides a proportionate, context-sensitive approach to the reconciliation of data protection and photographic freedom.
Photography is not merely a form of data processing. It is a form of art, a mode of journalism, a tool of documentation, and a medium of human expression. The law must treat it accordingly.
Notes
Bibliography
Belov S and Belikov V, 'Privacy and Photography in the Age of GDPR' (2020) 12 Journal of European Law and Policy 87
Coleman A, 'The Art of the Unposed: Street Photography, Privacy, and the Limits of Data Protection' (2020) 16 Journal of Art and Law 203
Duhnkrack C, 'Street Photography and the GDPR: Legal Challenges and Practical Implications' (2019) 5 European Data Protection Law Review 341
Gaines JM, Contested Culture: The Image, the Voice, and the Law (University of North Carolina Press 1991)
Kraljić S and Ünver MT, 'The Impact of GDPR on Street Photography: A Comparative Analysis' (2021) 7 European Data Protection Law Review 215
Kronenberg D, 'The Right to Erasure and the Photographer's Dilemma: Practical Challenges in the Digital Age' (2021) 13 International Journal of Law and Information Technology 156
Nissenbaum H, Privacy in Context: Technology, Policy, and the Integrity of Social Life (Stanford University Press 2010)
Schäfer B, 'Data Protection and Intellectual Property: The Unresolved Tension' in Beyleveld D and others (eds), The Convention on Human Rights and the Regulation of Property (Hart Publishing 2020)
Sontag S, On Photography (Penguin 1977)
Ustaran E, European Data Protection: Law and Practice (2nd edn, IAPP 2019)
Akintunde Idowu is a Barrister and Solicitor of the Supreme Court of Nigeria. He holds an LLM in IP and IT Law (High Merit) from Trinity College Dublin and an LLB (Upper Second Class Honours) from Obafemi Awolowo University. His research interests include intellectual property in AI-generated creative works, algorithmic governance, data protection law, and the regulation of artificial intelligence.
1. For a history of the legal treatment of photography, see Susan Sontag, On Photography (Penguin 1977); Jane M Gaines, Contested Culture: The Image, the Voice, and the Law (University of North Carolina Press 1991).
2. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1 (hereinafter 'GDPR').
3. Eduardo Ustaran, European Data Protection: Law and Practice (2nd edn, IAPP 2019) ch 3.
4. Christian Duhnkrack, 'Street Photography and the GDPR: Legal Challenges and Practical Implications' (2019) 5 European Data Protection Law Review 341.
5. GDPR, art 4(1).
6. ibid.
7. GDPR, recital 26.
8. GDPR, recital 51.
9. GDPR, art 9(1); see also Article 29 Data Protection Working Party, 'Guidelines on Consent under Regulation 2016/679' (WP259 rev.01, 10 April 2018) 18.
10. GDPR, art 2(2)(c).
11. Case C-212/13 František Ryneš v Úřad pro ochranu osobních údajů [2014] ECLI:EU:C:2014:2428.
12. ibid, para 33.
13. Svetlana Belov and Vitali Belikov, 'Privacy and Photography in the Age of GDPR' (2020) 12 Journal of European Law and Policy 87, 94-95.
14. Sandra Kraljić and Mustafa Tören Ünver, 'The Impact of GDPR on Street Photography: A Comparative Analysis' (2021) 7 European Data Protection Law Review 215, 219.
15. Belov and Belikov (n 13) 91; GDPR, art 4(2).
16. GDPR, art 6(1).
17. GDPR, art 6(1)(a).
18. GDPR, art 4(11).
19. Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV v Planet49 GmbH [2019] ECLI:EU:C:2019:801, paras 52-58.
20. Duhnkrack (n 4) 345-346.
21. Coleman has argued that street photography occupies a distinctive legal position because its artistic value depends precisely on the spontaneity and candour that the consent mechanism is designed to prevent. See Amy Coleman, 'The Art of the Unposed: Street Photography, Privacy, and the Limits of Data Protection' (2020) 16 Journal of Art and Law 203.
22. GDPR, art 6(1)(f).
23. Article 29 Data Protection Working Party, 'Opinion 06/2014 on the Notion of Legitimate Interests of the Data Controller under Article 7 of Directive 95/46/EC' (WP217, 9 April 2014) 30-35.
24. GDPR, art 85(1).
25. GDPR, art 85(2).
26. Charter of Fundamental Rights of the European Union [2012] OJ C 326/391, art 11; Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights, as amended) art 10.
27. Bundesdatenschutzgesetz (Federal Data Protection Act) 2017, ss 23-28.
28. Gesetz betreffend das Urheberrecht an Werken der bildenden Künste und der Photographie (Kunsturhebergesetz, KUG) 1907, ss 22-23. Section 23 permits the publication of images of persons of contemporary history without consent, subject to the legitimate interests of the person depicted.
29. Oberlandesgericht Köln, Decision of 28 May 2019.
30. ibid; Grundgesetz für die Bundesrepublik Deutschland (Basic Law for the Federal Republic of Germany) art 5(3); Charter of Fundamental Rights, art 13.
31. GDPR, art 17(1).
32. GDPR, art 17(1)(a)-(f).
33. GDPR, art 17(3)(a)-(e).
34. Case C-131/12 Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] ECLI:EU:C:2014:317.
35. ibid, para 97.
36. Case C-507/17 Google LLC v Commission nationale de l'informatique et des libertés (CNIL) [2019] ECLI:EU:C:2019:772, paras 64-73.
37. David Kronenberg, 'The Right to Erasure and the Photographer's Dilemma: Practical Challenges in the Digital Age' (2021) 13 International Journal of Law and Information Technology 156, 162-167.
38. ibid 168-170.
39. GDPR, art 17(2).
40. Berne Convention for the Protection of Literary and Artistic Works (1886, as revised) art 2(1); Case C-145/10 Eva-Maria Painer v Standard VerlagsGmbH and Others [2011] ECLI:EU:C:2011:798 (confirming that photographs may qualify as intellectual creations reflecting the author's personality).
41. GDPR, art 17(3)(a), read in conjunction with art 85.
42. Burkhard Schäfer, 'Data Protection and Intellectual Property: The Unresolved Tension' in Deryck Beyleveld and others (eds), The Convention on Human Rights and the Regulation of Property (Hart Publishing 2020) 187, 194-196.
43. GDPR, art 85(2).
44. Kraljić and Ünver (n 14) 222-224.
45. Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (as amended by Loi n° 2018-493 du 20 juin 2018), arts 67 and 80.
46. European Commission, 'Communication from the Commission to the European Parliament and the Council: Data Protection as a Pillar of Citizens' Empowerment and the EU's Approach to the Digital Transition - Two Years of Application of the General Data Protection Regulation' COM(2020) 264 final, 12.
47. Duhnkrack (n 4) 349.
48. Ustaran (n 3) 289-291.
49. Kraljić and Ünver (n 14) 226-228.
50. This approach draws upon the contextual integrity framework proposed by Helen Nissenbaum, Privacy in Context: Technology, Policy, and the Integrity of Social Life (Stanford University Press 2010).
51. Charter of Fundamental Rights, art 17(2); Protocol No 1 to the Convention for the Protection of Human Rights and Fundamental Freedoms, art 1.
52. European Data Protection Board, 'Guidelines 8/2020 on the Targeting of Social Media Users' (adopted 13 April 2021) para 108 (acknowledging the need for consistent interpretation of Article 85 across Member States).
53. GDPR, art 40(1).
54. This proposal builds upon the analysis in Schäfer (n 42) 196-200.
55. See European Data Protection Board, 'Work Programme 2023-2024' (February 2023) identifying the development of guidelines on freedom of expression and data protection as a priority area.
