This is a three A4 page read, so definitely worth making that coffee if you haven’t already!
Our discussions with
the ICO so far …
We have discussed a number of things with the ICO in relation to filming and GDPR. These were our concerns:
A release form is a consent form, filmed footage is data and under GDPR a person has a right to withdraw consent at any time. This could cause a few headaches if a contributor decides to withdraw consent.
People also have a right to rectification, which could create a quasi-editorial right over the films edit – for example if they believe a statement is only true when combined with another statement that we have chosen to remove. An assessment may refute this claim but processing would need to stop until it’s determined and in a time-critical environment this could prove problematic.
And then there is ‘special category data’ that for many clients may not be relevant, but for possibly our charity, government and law enforcement clients, it could be. For example, where the subject matter of the film is someone discussing their disability or political views or criminal convictions then we may very much be dealing with special category data.
The ICO have assured us that they are looking at these very scenarios and will publish guidance for filmmakers and photographers in due course. In the meantime, they have advised that we must do our best endeavours to act in the spirit of GDPR and to try and get it right. Which makes sense. After all, GDPR is a ‘principles based’ legislation with the onus being on us to act in the spirit of the legislation rather than simply following a series of rules.
Does GDPR apply to
the finished film?
First up is a reminder that GDPR applies to ‘personal data’, which means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
The ICO have confirmed to us that just because you can see someone’s face in a video, it doesn’t mean that they can be identified from it. I’ll admit, at first we didn’t fully understand this, “if I see a picture of me then I will know it is me” was our first reaction. The ICO pointed out that, “someone else watching the film won’t necessarily know who you are unless there is some other information telling them. You could even be an actor.” It is unclear where to draw the line on this because, “some people would identify me if they know me” seems a reasonably flippant response.
The truth here is that we may need to wait for case law (i.e. someone being taken to court) before further clarity arrives. The quest for answers on this one continues…
There has also been some discussion about images of people in relation to facial recognition and biometric data – that increasingly systems are capable of identifying someone from a photo (or video). Therefore, the argument proposes that a photo or video may be classified as biometric.
The consensus appears to be that the photo in itself isn’t an issue because on its own it’s not sufficient to identify you without combining it with other data to compare the photo to. Our instinct is that this is probably right but again, this is one to watch.
But whichever way the needle swings in relation to someone’s face on its own, if the video or photo contains other information that helps narrow that person down then GDPR will start to arise because it could make that person more readily identifiable.
Let’s start with the obvious – when we include their name in a name strap on a film. Other examples that the ICO provided to us is where we have filmed inside a company office and so you can limit the field down to a specific office in a specific location; or where the person is wearing their club shirt or some other identifying clothing – name tags at events beware! Indeed, the ICO pointed out to us that filming outside in Covent Garden with people walking past could pose less of a GDPR issue than filming inside a company office. We took this to mean that we have to look at it from a holistic perspective and take a real-world view of how easy it would be to identify someone. The ICO presumably used covent garden in their example because the population of London is huge and it’s a tourist spot so the person could be from anywhere. Taking this logic, it appears that we need to consider anything that could make someone more easily identifiable – not necessarily just places and names. What if we are making a film about someone who owns a Jaguar SJ220 (there are only 225 in the world) for example?
The reason this is important is because presumably that person is speaking and what they are saying may also include data and even more importantly, it may include sensitive data. So if you can identify them from their face and they are talking about (for example) their political view then all of a sudden, your film will be governed by explicit consent that is retractable at any time – because they are identifiable and because it’s special category data.
So our first understanding is that we will need to access if the work is subject to GDPR at all – before moving on to GDPR rules and the legal basis.
To ‘consent’ or not to consent?
As you are no doubt aware, we can only process data on the basis of one of 6 defined legal basis. The legal basis you use will determine which rights the data subject will have.
The legal basis of ‘Consent’ comes coupled with a right to withdraw consent at any time. We therefore believe that ‘consent’ is not the correct legal basis for this and we will instead be processing this data on the basis of ‘legitimate interests’.
We believe this to be the most appropriate because we would not always be able to stop using a film if an interviewee decides to withdraw their consent at a later date. This will impact our clients too disruptively and doesn’t take their (or our) needs into account. Whereas ‘Legitimate interests’ requires a fair balancing of the data subject’s rights against our own. This means that if their position is justified and ours isn’t then of course, we must act on it; and if we have competing interests then we have to work it out and try to get it right.
But this isn’t the whole story, because ‘special category’ data (and we do make films with ‘special category’ subject matter) requires a second legal basis, notably in our case, ‘explicit consent’.
Again, if the person is not specifically identifiable from the video then this may be less of an issue – the ICO pointed out to us that you wouldn’t necessarily know it wasn’t an actor, for example. But if the person is identifiable then we would need to have explicit consent that they can withdraw at any time.
Of course this is reasonable. ‘Special category’ data by its very nature does have the capacity to cause harm to people. The person we are filming may not have anticipated the impact on agreeing to take part and could find themselves in an unanticipated position that they need to stop.
So, where does this leave us?
We’ve developed a new system, more in tune with GDPR that will help us make data protection decisions on a case-by-case basis and then produce a bespoke release form for those interviewees and contributors.
We’ll make informed early decisions on what identifying information might exist in a film, such as the inclusion of name straps or special category data and deal with it accordingly.
And of course, we’ll be keeping up to date on all things GDPR and how it affects our industry and we will evolve as a business in tune with this.
Our privacy policies
This is because the information we collect and how we use it will vary depending on what our relationship is with that person. We therefore have separate policies for people appearing in our projects (not including actors), for suppliers and staff and finally for everyone else including our clients and prospective clients. If you’d like to take a read they can be found here –
Contributors policy (for people appearing in one of our projects)
The contents of this post are our opinion only and shouldn’t be construed as legal advice (that we are not qualified to give).