In short
The General Data Protection Regulation (Regulation (EU) 2016/679), known in German as DSGVO, sets the rules for how personal data may be processed in the EU. It has applied since 25 May 2018 (Article 99). Personal data means any information relating to an identified or identifiable person (Article 4(1)), so a photo in which someone can be recognised can count.
Anyone processing data that falls under the GDPR needs a legal basis, such as consent or a legitimate interest (Article 6(1)), and has to follow principles such as transparency, data minimisation and storage limitation (Article 5). You can read every article in the official text of the GDPR on EUR-Lex.
For private parties, one exception matters most: under Article 2(2)(c), the GDPR does not apply to processing by a natural person in the course of a purely personal or household activity. This is often called the household exemption.
This entry is general information, not legal advice.
Photo: Josh Power / Unsplash
Example
At a wedding, guests take photos on their phones all evening. If the pictures stay with family and friends as keepsakes, that points towards the household exemption. The data protection authority of the German state of Baden-Württemberg names photos taken as personal mementos at family celebrations as an example. It takes a different view once photos are published on a freely accessible website: in its view, that is no longer a purely personal or family activity (LfDI Baden-Württemberg FAQ on photography and data protection, PDF in German).
If a company collects photos at its Christmas party, the exemption doesn't apply in the first place, because it only covers natural persons. For practical ways to gather pictures from your guests, see how to collect photos from guests.
What to watch out for
- Private isn't the same as public. Looking at photos with the people who were there is different from posting them publicly. Exactly where the line falls depends on the case.
- Germany has an extra layer. Besides the GDPR, German law protects a person's right to their own image: under § 22 of the Art Copyright Act (KUG), pictures of a person may generally only be distributed or shown publicly with their consent, with exceptions in § 23 KUG. How the KUG and the GDPR fit together is described by the Baden-Württemberg authority itself as complicated and disputed.
- Don't keep data longer than needed. Where the GDPR applies, data should only be kept in identifiable form for as long as its purpose requires; see retention period.
- People have rights, for example the right to have their data erased (Article 17).
- The file says more than the picture. Photos can carry EXIF data such as capture time or location.
- When in doubt, ask. Especially before publishing, or at work events, it pays to ask the people in the photo or get proper advice.
With Filmriss
Filmriss keeps photos in storage located in the EU and deletes them automatically 90 days after the reveal; details are on what happens to the photos.
