When taking pictures/videoes, there are a number of things to consider and take into accoundt before, during and after.
Before taking pictures, consider whether SDU has an image you can use:
SDU's image ressources (at the bottom of the page)
As a general rule, you are welcome to take pictures at events at SDU if the pictures/videos show something about running a university, have a valid purpose and are in no way offensive or of an exposing nature. However, it is important that before the pictures are taken the people in the pictures are informed about the purpose, legal basis, any disclosure, how the pictures are stored, etc. (duty to inform).
Examples of situations where it is not necessary to obtain consent (but still remember the duty to inform) could be: Pictures/video from a graduation, pictures/video from a professional conference/event, pictures/video from the Annual University Celebration (but not from the bar or other places where people may feel exposed).
Contact your local GDPR coordinator if in doubt. When photographing a presenter, it is good practice to ask him or her in advance, even if it is not a requirement.
In many contexts, you can take pictures without consent as SDU has a different basis for processing. However, you may need consent if:
- The picture reveals confidential or sensitive information
- The way you want to use the picture can reasonably make the person(s) in the picture feel exposed, exploited or offended (e.g. if you want to publish pictures from a party or if you use the pictures for marketing purposes)
- The picture depicts a specific person in a situation where they themselves should have the opportunity to decide whether they want to be photographed (e.g. public employees who are at work).
If you are in doubt, SDU RIO can guide you as to when consent is the most appropriate legal basis and can provide a declaration of consent. Contact SDU RIO.
If you end up basing your processing of personal data on consent, make sure that the declarations of consent are stored securely. The most important thing is that they are stored in an approved SDU system (e.g. SharePoint or Acadre) and that they can be quickly retrieved in the event that the data subject withdraws his or her consent.
There are a number of things to consider before, during and after taking pictures/videos. The most important things are:
Before:
- Find out if consent is the correct legal basis, or if you can use a different (more appropriate) legal basis.
- The persons depicted must be informed (and consent may need to be obtained) that pictures/video will be taken (duty to inform). In connection with the duty to inform, you also have to consider the purpose of taking the pictures, where they will be published, how long they will be stored, whether they will be shared with others and much more. Contact your local GDPR coordinator for guideance on the duty to inform.
During:
- Only take pictures/videos that are compatible with the purpose you have stated in the information text. For example, if you take pictures of the Annual University Celebration, an event at the department or something else (and this is what you want to show), do not suddenly take pictures/video incompatible with that purpose (e.g. people at the bar as they could potentially feel exposed).
- If the persons do not want to participate in the pictures/videos, you must respect that – even if you do not base your processing on consent.
After:
- Make sure that you do what you have stated in the duty to inform with regard to sharing with others, how long the pictures are stored, etc. The material must also be removed from e.g. the website (and from your personal archives) if you receive an enquiry about this (both with consent and without consent as legal basis). Therefore, also make sure to name or ‘tag’ pictures so that you can find them again quickly.
- Make sure that the pictures are stored securely in approved SDU systems (e.g. SharePoint or Acadre).
- To know the legal basis (and obtain consent, if relevant, of the data subject(s)).
- Proper storage of pictures/video (and consent, if relevant). They could be stored in e.g. SharePoint or Acadre.
- Delete pictures/videoes according to the information you have given regarding compliance with the duty to inform (or if the consent is withdrawn).
You can read more on the Danish Data Protection Agency’s page about pictures on the internet here (in Danish).