Alamy Statement on GDPR issues
Alamy has reviewed and considered in detail the compliance of its business with the General Data Protection Regulation (GDPR). Following such review Alamy has taken steps to ensure compliance and is confident that it will meet the challenges of the new law.
Alamy believes that the key risk scenario arising from the GDPR is where a photograph with a living person as its main focus is linked with personal information identifying that person, such as name, address or location. Alamy’s contributor contract has been amended from 25 May 2018 to provide that linking such personal information to a photograph of a living person will only be allowed for journalistic and news reporting purposes, where the person has given consent or for other legitimate reasons.
Alamy’s lawful basis for licensing images under the GDPR will include its legitimate interests. These legitimate interests arises from its provision of photographs for a range of primarily editorial purposes, including news reporting, commentary, educational textbooks etc., that are of clear benefit to others and in the public interest. Alamy also expects to rely on the exemptions in the GDPR regarding the use of personal data for journalistic, artistic and academic purposes.
Alamy’s view is that metadata included with an image, including location or date/time information, is unlikely in and of itself to materially increase any risk of GDPR non-compliance.
The journalism and new reporting exception permits images of celebrities/well known or newsworthy people to be used. The legal basis for the processing would be the exemption for journalistic purposes set out in the GDPR (Art 85). In the UK implementing legislation a public interest test is incorporated.
The consent exception could be satisfied by a model release or another form of explicit consent.
The “other legitimate reason” exception also sits under the legitimate interests basis of lawful processing. As with all cases involving legitimate interests it would involve a balancing of the rights of the person whose details are included with those of Alamy , its contributors and customers. The following could form some of the justification for invoking legitimate interests:
The provision of photographs for a range of editorial purposes, including news reporting, commentary, educational textbooks etc., that are of clear benefit to others and in the public interest;
There may be a limited privacy impact on any individual that is a public figure, as they might reasonably expect their data to be used in this way;
It would not be practical in many circumstances to give the individual full upfront control (i.e. consent) or bother them with disruptive consent requests.
Other legitimate reasons generally involve the use of a person’s personal details in conjunction with an image in circumstances where it would be expected and natural to use such personal details in that context. For example, the use of an architect’s or inventor’s name in conjunction with a building or invention. It would not be possible to provide a full list of all circumstances in which the exception would apply but guidance will be placed on the contributor area of the Alamy website.
Alamy notes that the GDPR indicates that processing of a photograph will not be treated as sensitive personal data unless used for facial recognition or similar purposes. The UK supervising authority the ICO has also commented that photographs of living persons shown in street photographs will not be considered biometric data for the purposes of the GDPR and Alamy expects that the position will be similar in other countries.