Photos and videos

In the case of photographs and videos, there are circumstances in which lawful processing (i.e. recording and storage) may take place without first obtaining consent from the data subjects. This applies in particular where the recordings are required for the University's public relations work (Article 6 (1) lit. e of the GDPR in conjunction with Article 2 (1) of the Bavarian Data Protection Act (BayDSG), Article 2 (6) of the Bavarian Higher Education Act (BayHSG)) and, furthermore, the conditions for what is known as a 'portrait from the field of contemporary history' (Section 23 (1) No. 1 of the KunstUrhG) are met.

• Portraits relating to contemporary history (Section 23 (1) No. 1 of the KunstUrhG): Whether a particular case constitutes a contemporary historical event – and whether photographs of the person(s) concerned are therefore permissible even without their consent – must be assessed on a case-by-case basis, taking into account the fundamental rights of the persons concerned as well as freedom of expression and freedom of the press². A key factor in this assessment is, amongst other things, the public's interest in information. The greater this interest, the more likely it is that a photograph or video may be taken even without prior consent. Consequently, images taken without consent are permissible, for example, in the context of public relations work.  
  An example of a current affairs event would be the official opening of a new university building complex by the university management. Taking photographs and videos during this event, in which members of the university management are recognisable within the context of the public ceremony and which are intended for subsequent reporting on the event, would therefore be permissible even without the prior consent of those depicted. Furthermore, in this context, it is usually also permissible to depict members of the public without their consent – provided that the focus is on the specific event (and not on the person depicted as an individual). If the photographs show public figures not in their official capacity during a contemporary event, but privately in an unofficial context, the following applies: the less information the taking of the photograph and the associated reporting provide to the general public, the greater the need to protect the privacy of the person depicted. It is therefore not permitted, for example, to take photographs of university management outside of public appearances without their consent. In such cases, the public's interest in the information is generally not sufficiently high to justify taking photographs or videos without consent.

• Persons as accessories (Section 23 (1) No. 2 KunstUrhG): This scenario concerns "images in which the depiction of the person is secondary to the overall representation"³ . If you take photographs or videos of a landscape (or, for example, the university) in which 'people happen to be in the picture'⁴, these images are also permitted without the prior consent of the persons depicted. However, people may only be accessories alongside landscapes or other locations – not alongside other people⁵.

• Images of gatherings, processions, and similar events (Section 23 (1) No. 3 KunstUrhG): These must involve "gatherings of people with a collective intention to do something together"⁶. There is no fixed rule specifying the minimum number of people required for an event to be considered a gathering. Furthermore, the gathering must "take place in public and be perceptible to the public" ⁷and there must be "an intention to be noticed by third parties"⁸. If these conditions are met, you may take photographs of the gathering without first obtaining the consent of all participants depicted. However: "Here, too, the decisive factor is that it is the gathering itself – and not primarily its participants – that is depicted"⁹.

• The overriding interest of art (Section 23 (1) No. 4 KunstUrhG): If the distribution or public display of a photograph or video serves the overriding interest of art, such acts are permitted even without the consent of the persons depicted. Artistic considerations must take precedence over commercial or entertainment purposes, and – as in the scenarios above – the interests and rights of all parties involved must be weighed up on a case-by-case basis.

As a general rule, however, where it is possible to obtain consent from all persons depicted, this option should be preferred.

Regardless of the basis on which personal data is processed (whether by consent or some other form of legal basis), the information requirements set out in Article 13 of the GDPR must be met. A list of the minimum information that must be provided to data subjects can be found here.

Where the personal data consists of photographs or videos, it may prove difficult in practice – particularly where no written consent needs to be obtained –  to provide the data subject with all the necessary information at the time of data collection (i.e. before or during the recording).

In such situations, there are a number of ways in which the duty to provide information can still be fulfilled in an appropriate manner:

• The data controller's website: The information listed above can be made available to data subjects via a website, amongst other means. Those pictured must then be informed that such a website exists and how it can be accessed. Here too, the information – and in this case the entire website – must be easily accessible (or findable) to the data subjects. If there is a website containing information about the event, which those present are ideally already familiar with, it makes sense to publish the data protection information there as well.

• Putting up information boards: The duty to provide information at an event may also be fulfilled on site by putting up information boards, displaying information posters or similar notices. These must contain the information mentioned above and be placed where they are clearly visible to all those present (for example, at the entrance). Alternatively, or in addition, the notices may also include a link or QR code to the organiser's website, where the information can be accessed.

• Information in invitations / when registering for the event: You may also provide the data subjects with this information in advance, either in a written invitation or when they register for the event in question. In doing so, you may either set out all the necessary information regarding data processing or provide a reference to the data controller’s website (as described above).

• Handing out information cards: If there are no invitations or registration requirements for the event at which you are taking photographs or filming, you can, of course, hand out the information on site in printed form (e.g. on small cards, such as those frequently used by party photographers), regardless of this. Here, too, instead of providing all the information, you can simply include a link to the relevant website of the person responsible, where all the details can be found.

It is also possible to combine these methods of providing information: for example, you can refer to the website – where all information on the processing of personal data can be found – both in the invitation or registration details for an event and on information boards at the venue. In addition, you can hand out the link or QR code to the website, along with a corresponding note, to those present on small cards to take with them.

But please note: fulfilling the duty to provide information does not replace the need for consent!

The information requirements apply regardless of the legal basis for the processing and must be met in all cases – irrespective of whether the images are taken and processed with or without the consent of the person(s) depicted. It cannot be assumed that persons present have given their consent simply because they have taken note of the information on data processing (e.g. on information boards at the entrance) and are 'nevertheless' attending the event. The procedure described is intended solely to ensure that your duty to provide information is adequately fulfilled in cases where data processing is permissible without consent anyway (as in the example of the building opening).¹⁰

If the recordings are authorised by the consent of the data subjects, the information channels listed above may, of course, also be used. In such cases, however, it is advisable to provide the necessary information directly when consent is given (see: consent). This allows you to obtain written confirmation – in the form of the data subject's signature – of both their consent to data processing and their acknowledgement of the information, and, if necessary, to demonstrate the lawfulness of the processing and your compliance with your duty to provide information.