GDPR and images of people — what do the rules actually say
Consent special protection of children and legitimate interest
As a photographer you create daily images of recognisable people and such an image can constitute personal information. When the images are used commercially — published sold or marketed — you are subject to data protection rules (GDPR) in the same way as any other company processing personal information.
§Legal basis: consent or legitimate interest
To be allowed to publish a picture of a recognisable person in a business context you must have a legal basis. This can either be consent from the person or the fair interest rule which companies and self-employed people can often use if the interest in publishing the picture outweighs the person's interest in not being shown.
§The Danish Data Protection Authority's approach: a concrete assessment
The Danish Data Protection Authority has moved away from the old distinction between 'portrait images' and 'situation images' and now makes a concrete assessment based on the image itself, where it was taken, when it was taken, and the purpose of publication. This gives more flexibility, but also requires you to actively consider the concrete situation each time rather than relying on a fixed rule of thumb.
§Images taken in publicly accessible places
As a general rule, you may photograph and publish images of people taken in publicly accessible places without consent if you have a legitimate reason and if the people in the image cannot reasonably be said to feel exposed, exploited, or violated. This applies, for example, to street photography and news images from a public event — but the decision always rests on a concrete assessment of each situation.
§Special protection of children
Children and young people must have special protection. If the person in the image is under 15 years old, you must, as a rule, obtain consent from the parent or guardian before publishing the image. This applies to situation photos where the child is not the main subject but is clearly recognizable — therefore be extra careful when photographing at schools, institutions, and family events.
| Situation | Typical legal basis |
|---|---|
| Portrait commissioned and paid for by the customer | Consent from the customer/the depicted person |
| Reportage at a publicly accessible location | Legitimate interest if no one feels offended |
| Marketing image of employee | Often legitimate interest or consent—assessed case by case |
| Image of child under 15 years | Consent from the person with parental authority |
§Sensitive information and your own responsibility
If an image contains sensitive information — for example about health, religion or criminal matters — it can rarely be published without consent, regardless of where it was taken. Also remember that as a photographer you are the data controller for photos you keep and use professionally, regardless of what responsibility your client has. Safe storage, clear agreements and sound judgment are your best protection against conflicting with the rules.