Last December, Facebook announced that a software bug allowed a third-party developer to access the photographs of nearly 7 million users, regardless of whether these photos were shared or not.

This brings to light related data-privacy questions that associations have been asking regarding the use of photos and videos from their meetings and other events: Following the European Union’s General Data Protection Regulation (GDPR) going into effect, can associations continue to use these assets to market and promote their events? Do organizations need consent from every person in a photo?

If we are talking about general images of attendees who are going about their business at an association event, it is important to alert them that photography or filming is happening in the vicinity. And when an individual is identifiable, associations may want to seek out consent, as defined by GDPR.

Collective shots of conference sessions are allowed, but where individuals are identifiable in small groups—perhaps two to three people chatting over coffee—then a photographer should seek consent. 

Associations should take this opportunity to explain their interest in these assets and to reassure individuals that they are not going to sell images inappropriately.

Equally, where there is general filming or photography taking place at events, a notice should be placed at conference check-in or in hallways to alert attendees. Then, if they wish, they can ask not to be filmed or recorded. 

Such consent is unlikely to be an issue for conference speakers or those who ask questions during a meeting. The lawful basis for data processing of “legitimate interest” would apply, as they have a reasonable expectation that the conference organizer would use any images in future publicity or news items about the event. 

It may be sensible, however, to ensure that speakers understand their consent when agreeing to participate and refer to it in their terms of the agreement. Associations should also take this opportunity to explain their interest in these assets and to reassure individuals that they are not going to sell images inappropriately. 

If an organization intends to allow selected third parties to reuse images (e.g., media, sponsors, exhibitors, and so forth), it needs to consider seeking express consent, as it is not a reasonable expectation—therefore a legitimate interest—for delegates to expect or assume that people outside the organization might use their images.

With regards to speakers, award winners, and those who ask questions in open sessions, these situations would be covered by legitimate interest. When people apply for an award, there would a reasonable expectation that they also expect the association to use any images in publicity and press reports across relevant media. However, organizations should be transparent in the relevant documentation with calls for nominees and explain how they intend to use photos in the follow-up publicity of awards. The same standards to those who accept invitations to judge awards. 

Also remember that consent it not limited to marketing materials and event promotion: It also applies to media posted to social accounts like Twitter, Facebook, LinkedIn, or Instagram, which may document an event or anything that flows from event coverage. But provided associations have followed a few practical steps, they should always have a legitimate interest in gathering and distributing media assets.