Photographs are now an everyday occurrence. When you go out to dinner, a concert, or a night out, people are snapping, videoing, and even going live on social media; it’s an excellent method to produce memorable images for parties and celebrations.
When they do take these photos and videos, people think nothing when putting them on various social media platforms. In truth, many people would not want their images saved or shared by others, especially if they show inebriated partygoers.
And the Office of the Data Protection Commissioner (ODPC) reminded us of this the hard way by fining a Nairobi nightclub for using a person’s photograph for commercial purposes without their consent, shocking the entertainment sector.
Read: Kilimani nightclub fined Sh1.8m over reveler photo
As a result, most establishments hastened to issue fairly generic “consent disclaimer notices,” stating that revellers who enter their premises should know that they have consented to be photographed and that their images will be used commercially and in perpetuity. But the big question is what does the law say about these disclaimers?
Duty to notify
Insofar as Data Protection legislation is concerned, an individual’s first right is to know how their personal data will be used. A data controller or processor must, to the extent practicable, inform a person before collecting personal information about them.
These comprise the rights of the data subject as set forth in section 26, the fact that personal data is being collected, its intended use, any recipients of the information that may be transmitted, and the protective measures in place.
Additionally, they should provide contact information for themselves and any other potential recipients of the data, describe the security measures in place, clarify if the data collection is mandated by law, and explain the consequences if the data subject chooses not to provide certain requested information.
Consent
According to the Act, consent is a unique action done by a data subject to grant an organisation authorization to collect and/or handle personal information about him or her.
Consent can be granted and received in a variety of ways, including the following at the time of data collection, prior to data collection and through a third party.
Thus, data subjects must be notified of data processing in a transparent and appropriate way and at the appropriate time. You must get formal permission from anybody who may appear in images or videos. Before you film footage, you must obtain the consent of everyone who will appear in a photograph or video.
In the consent form, you must state why you are utilising that person’s photograph and where you intend to use it. A picture release form must also be completed and identify all of the locations where the photo or video may be utilised.
Remember that consent can be withdrawn at any time. Because the right to withdraw is ‘at any moment,’ providing an opt-out merely by reply is insufficient. Individuals must be allowed to opt out on their own initiative at any moment.
It must be just as simple to withdraw consent as it is to obtain it. This implies that withdrawing consent should be a simple one-step procedure. Individuals should be allowed to withdraw their permission in the same way that they provided it, if practicable.
When an individual withdraws their consent, all videos or photos of that individual should be erased.
Those who do not give their consent to be in a video or photo do not need to sign the consent form. Perhaps you could create a film-free area within your establishment or provide wristbands and make sure that those who are filming or taking photos are aware.
Auxiliary, the data subject has the right to object to data processing. The data subject’s right to object must be explicitly brought to their knowledge and provided clearly and independently from any other information.
This implies that images posted on social media must be erased as soon as a complaint is raised via the notification.
Remember intoxicated persons don’t have the capacity to consent.
Read: Naivas faces Sh5m fine for late reporting client data theft
Commercial use of personal data
In addition to the aforementioned discussion, photographic works in its many forms, such as selfie and portrait photos, are copyrightable.
Thus, in addition to privacy, additional interests arise, such as the individual (subject) in the photo’s personality/image rights and copyrights owed to the photographer/”hirer,” but this is a topic for another day.
In view of the penalty notices by ODPC, generic disclaimers will not suffice. Entertainment venues and event organisers will need to engage experts to re-craft their disclaimers with the following factors in mind: lawful basis for data processing, minimising data collection, managing consent effectively, evaluating third-party vendors’ compliance, implementing data security measures, commercial use aspects and adapting to technological advancements. BY BUSINESS DAILY