FAQ GDPR and images: photos/videos on websites and during events

No, the requirements are the same. The 'UT website' thus always concerns both the internet and intranet. In addition, the UT uses other public channels such as Twitter, Instagram and Facebook. The same principles apply to these official UT channels.

Yes, provided that the following conditions are met:

• Inform all attendees in advance that photos will be taken of the event, for example by including this in the announcement of the event and mentioning it on entry.
• Allow those concerned to indicate, depending on the circumstances of the event, that they do not want to be photographed. Think of agreements about not photographing certain (parts of) rooms, or personally relay it to the photographer.
• Make sure that children are not photographed recognizably, unless parents have consented for publication of the photo.
• Never photograph people against their will.
• On publication of photographs, in addition to the General Data Protection Regulation (GDPR), the portrait right also applies. Publication of photographs is only permitted if the 'reasonable interest' of the person involved is not jeopardized. In short: do not publish a photo of which you can expect that the person involved does not appreciate this and remove the photo immediately when someone objects to publication.
• Portraits can be made of speakers, chairmen and the like, but only if they have given permission for this.
• Do not use the photos for purposes other than the report of the impression of the event, for example for publication on other websites or in magazines. This is only allowed with the explicit consent of everybody in the photo.
• For photos on the UT website, publish contact details where someone can object to the publication. The contact details must be easy to find and the response to questions or objections must be quickly. Remove the photo immediately if someone objects to the publication.
• There has to be a legal basis for processing photos. Because permission has not been requested, this will usually be 'legitimate interest'. The processing must be registered via the web tool. A recurring event whose processing is always the same, only needs to be recorded once.

Yes, the same requirements apply as for public events (see previous question). In addition, a private event demands:

• Ask the participant for permission to take and publish photos at the application for the event. Make arrangements to avoid being photographed and explain to participants how to use these. Think of arrangements about not photographing certain (parts of) rooms, or personally relaying the wish not to be photographed by the person concerned to the photographer.
• Sometimes it is impossible to guarantee that the participant in question will not be photographed, for example because of the size of the event, the space, or the number of photographers involved. Then replace the request for permission by announcing that photos will be taken, whereby the participant must tick the checkbox to confirm to be informed. Please state that we take all reasonable efforts to prevent unwanted publication of photos, in accordance with the law. Make arrangements to realize this and communicate how to use these, for example through personal contact prior to publication.
• A legal basis is required for the processing of the registration data and the photos, if possible 'permission'. The processing must be recorded via the web tool. A recurring event whose processing is always the same, only needs to be recorded once.

Yes, permission to take portrait photos is required, in this case from the graduate. But also portrait photographs of those who gives the diploma, speakers, chairmen and the like can only be made if they have given their consent.

The photographer keeps the copyright on the photo, but cannot use these photos without permission from the client (ie the UT) for other clients or other expressions. When the photographer asks the UT if it is allowed to reuse a particular photograph, the UT refuses if the person concerned has withdrawn consent or objected. Implementation of this takes place via M&C or the client.
When a person portrayed requests removal of a photo, the UT will contact the photographer in question. The photographer has the copyright on the photo, but, like the UT, must follow the rights of the photographed participant. This is not only about the right to privacy, but also about portrait rights.
Without permission or objection, the photo may no longer be published, unless the participant explicitly states that the objection only applies to publication on the UT website and not for other publications. When sharing photos between photographer and UT, consent / objection must also be communicated, even if it changes over time.

Granting or withdrawing permission always applies from the moment this is indicated, never with retroactive effect. If the person concerned also wants the photos removed, weigh the disadvantage for the UT against the request.
In the quitclaim form, the person who is photographed consents for the use of the photograph in all UT products or exclusively for a specific product in advance.
Please note, these are photographs that have been published with permission. This is a different situation than objecting to photographs for which no explicit permission has been granted. In that case, you must always respond to the request to delete photos.
Withdrawing consent applies to future (re)use of the photos in any form whatsoever. For example, it is not allowed to create a new web page using the same photos or to include them in a folder or magazine. When reprinting a flyer or magazine, it is fair to no longer use the photo in question.

Use the data from PeoplePages for contact details or a ‘who-is-who’. Each employee indicates here whether a photo is available for internal and / or external use. By referring to this contact data, the same privacy settings are automatically followed.

Yes, photos are available in the image bank of M&C and UToday (see image bank). The copyright is included with every photograph, you are allowed to use most photos for publication on the UT website or in other formal UT publications. UT-clients provide the consent of the persons portrayed in advance, so that those involved are informed of possible follow-up. Examples of forms for requesting consent will be included in the ABC services by M&C. Note: in the past consent has not always been requested. Be as careful as possible when using this material.

The same requirements apply to video material as to photos, the previous questions and answers are therefore applicable for creating and publishing videos.
In practice, however, there is an important difference. With photos, it is usually not a problem to delete one or a few photos when someone on it objects to or does not consent to publication. However, it is not always possible to delete the image of a specific person from a video recording without the making the video unusable. So keep this in mind when asking permission or informing about the recordings and their purpose.

Short answer (explanation below): Decide what the purpose of the photographs/camera images is. In case this is not differentiation based on special categories of personal data (such as race/ethnic origin)? Is it not reasonably foreseeable someone else will make differentiate based on your photographs/camera images? And is it inevitable that you process special categories of personal data when you take the photographs/camera images? Then the processing of photographs/camera images will not be considered to be processing of special categories of personal data and it is not prohibited to process them. Of course, this processing is subject to the other GDPR requirements (so you will need to have a purpose and legal ground).

Explanation: The GDPR prohibits the processing of special categories of personal data, unless there is a specific legal ground to process such data. Special categories of personal data include the following information:

• Race and ethnic origin;
• Religious or philosophical beliefs;
• Political opinions;
• Trade union memberships;
• Biometric data used to identify an individual;
• Genetic data;
• Health data;
• Data related to sexual preferences, sex life, and/or sexual orientation.

It might be possible to deduce someone’s race/ethnic origin from a photograph/camera images. Does this mean that photographs/camera images are considered to be special categories of personal data? This would mean that it is prohibited to process photographs/camera images, unless there is a specific legal ground to process them.

The Dutch privacy authority states that you process “regular” personal data – so no special category of personal data – if all of the following points apply:

• The photographs/camera images are not intended to be special categories of personal data or are not intended to make a differentiation based on these data;
• You can not reasonably expect for someone to differentiate based on your photographs/camera images;
• It is inevitable that you process special categories when you take the photographs/camera images.

In general, you will probably process “regular” personal data with an address book with photographs of employees on intranet, a class photo or the promotion of an event.