Taking Photos in Public Places – Best Practice

16th February 2022

There has been a recent case in the Rotterdam Court of First Instance (original court transcript in Dutch), which considered a company that had the right to process personal data due to their legitimate interest – the interesting fact being that in this particular case the Controller’s legitimate interests was deemed to outweigh the data subject’s rights.

The Facts

The Data Controller, Coolblue, is a company that sells electronic products. The Data subject was employed at Coolblue for three years, and during this time, Coolblue took photographs of the data subject for the reason of promotion/marketing of the business. The Data subject had their photo on around 100 Coolblue vans and it also featured in a promotional video on Coolblue’s YouTube Channel. 

After the data subject had left the organisation, they claimed that Coolblue should have requested their consent to use their photo for marketing material as this is their personal data. The Data subject expressed that Coolblue had no legal basis for processing/using their personal data as they had revoked their consent three months after leaving the organisation, as per their rights according to Article 7(3) GDPR.


The Rotterdam Court of First Instance rejected the data subjects’ claim that Coolblue had no legal basis for processing their personal data.

The Court considered that the Data Subject’s picture and video fell within the material section of the GDPR due to the personal data being processed. They did note that the data subject revoked their consent, and Coolblue could therefore not rely on consent (Article 6(1)(a) GDPR) as a legal basis for the processing of data subject personal data.

However, although Coolblue could not rely on the data subject’s consent, the Court explained that they could rely on Article 6(1)(f) GDPR – legitimate interest. Coolblue had a genuine interest in processing this particular personal data, which overrode the data subjects’ fundamental rights.

The Court noted that the organisation had a commercial interest, and it was legitimate. The costs for Coolblue to remove the image of the data subject would be incredibly high and would have a significant impact on their business. Furthermore, Coolblue did state that they would accommodate the data subject’s interest, and their Coolblue vans with their picture on will be phased out and the promotional video on YouTube would be removed.

Due to this situation, the Court understood the processing of personal data was necessary and outweighed the rights and freedoms of the data subject.

What is the best practice for taking photos?

In an ideal world, organisations would get the explicit consent of everyone at the time a photograph or video was taken. However, where this is not possible, choose an area that can be controlled and, where possible, place clear signage in the area stating that recording and/or photography is taking place. Individuals will then have the choice to avoid having their image captured and can walk around your camera’s field of view or place an objection to processing.

You could also consider anonymising the personal data by removing the identifying characteristics, such as blurring their faces. This would be useful if you were shooting in a city centre or using a drone to capture your images/video.

When taking photographs or videos at events or exhibitions, organisations cannot shoot as freely as they would in a public place. If an organisation is running the event, they should ensure that they have an individual’s consent before taking photos, preferably in advance of the event starting.

Here are two crucial points to consider:

  1. When attending third party events or exhibitions, Controllers should contact the organiser ahead of time to ensure that photography is permitted.
  2. Controllers should ensure that they have a lawful reason for taking the photos, with consent once again being preferable.

We currently live in a world where every smartphone owner is a possible photographer.

Unfortunately, the GDPR doesn’t have a precise guide on when one is allowed to take and publish photos of the public. However, using common sense and a balanced approach will go a long way towards ensuring that individuals’ rights are respected.

If in doubt, please use your complimentary half-hour Zoom consultation with one of the Griffin House data protection specialists.  You can book yours here.

Let us ease your mind

If you have any queries, questions or requests then please get in touch. We’re always very happy to talk, you’ll find a friendly voice on the end of the line or simply fill out the form below.

    Your Contact Details

    This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.