Images and film – personal data and copyright
When do you need written consent from the person you are photographing or filming? And when are you required to provide the photographer’s name in connection with the image? Here you will find a summary of important things to consider when working with images and film.
General Data Protection Regulation (GDPR)
The GDPR is a regulation in common EU law that governs how personal data can be used. Personal data refer to information that can be directly or indirectly related to a living individual, such as name, personal identity number and photos.
Legal basis
You are required to have a purpose for processing personal data. Your purpose must fall within one of the six legal bases set out in the GDPR. What your purpose is will determine which legal basis you should rely on.
According to the Higher Education Ordinance, all higher education institutions in Sweden are tasked with research, education and collaboration. For Lund University to fulfil that remit, our communication needs to be clear and effective. This applies all the more when we use images and videos. Our purpose in communicating with images and videos is thus to fulfil our remit as a public authority. The legal basis we are therefore relying on is designated as a task carried out in the public interest.
Always inform people about photography and filming
You must tell any person you want to photograph or film that you are doing so on behalf of Lund University and provide information on how we process their personal data. When you ask someone if they want to be photographed, point out very clearly that the images may be used on social media. Also instruct the photographer to point this out clearly if you cannot attend the photo session.
All the information we are required to provide is summarised on the pages below:
Processing of personal data in the form of images and videos – lunduniversity.lu.se
You can provide all the information to those people you want to photograph or film by giving them the document below:
Processing of personal data at Lund University (PDF, 139 kB, new tab)
When organising an event, you should preferably point out in the invitation that photography and/or filming will take place. Refer to the information page on the website. Also provide information at the entrance to the event. Ask the photographer to avoid, as far as possible, crowd shots where people are recognisable and to use a short depth of field so that only the essential people are visible. If possible, you should also provide photo and video-free zones for those who do not want to be on camera.
The University’s contracted photographers recognise that the GDPR may affect the assignments they receive from us. Make sure you give them all the relevant information before the photo session, such as mentioning social media use to the people they want to photograph.
Images that are not the University’s own
Please note that people in images that are not the University’s own may not have given consent or entered an agreement. So, check carefully whether you can publish images bought from an image agency or downloaded from the internet without violating the GDPR.
Use outside the EU/EEA
In some cases, we transfer personal data to third countries, i.e. to countries outside the EU/EEA, for example through publication on social media. Think carefully before posting an image on platforms and systems based outside the EU/EEA.
Publication under licence
Publications made under a publishing licence, i.e. when there is a responsible publisher, are not affected by the GDPR. However, always provide information on how Lund University processes personal data as the images may be reused in other contexts.
The guidelines may be subject to change
Lund University’s guidelines on how we use personal data may change according to how the GDPR is interpreted. You can find the latest information on the website of the Swedish Authority for Privacy Protection. This authority is responsible for ensuring compliance with the GDPR in Sweden.
About the GDPR in Sweden – Swedish Authority for Privacy Protection
See also the University’s information on personal data and data protection
Frequently asked questions
EEA is an abbreviation for European Economic Area. The EEA countries are Iceland, Liechtenstein and Norway and they have an equivalent level of protection for personal data and privacy as EU Member States.
Most social media platforms are based outside the EU/EEA. Under the GDPR, we cannot actually use any images with identifiable individuals outside the EU/EEA and guarantee the protection of personal data, but it is questionable whether we are fulfilling our remit effectively if we communicate without images and videos. Be especially vigilant with images and videos on social media. Think about whether you can use images without identifiable individuals or with as few people as possible.
We need to be able to show images from our core operations – research, education and collaboration. Doctoral degree conferment ceremonies include two of them – research and education – and are therefore a major event that we need to be able to show in images. Nor can you expect to be completely anonymous in a public place. Ask the photographer you hire not to include more people than necessary in the images and to use a short depth of field.
It is not possible to prove that anyone has read the information on how the University uses the images. The data protection officers have concluded that we should no longer use the legal basis of consent. What we can do with the new interpretations is to offer clear written information and also always be clear when we ask about photography or filming – by saying both that we are from Lund University and that the images may be used in different channels and contexts, for example on social media. Corporate Communication has concluded that this is a reasonable approach. However, there is no guarantee that our approach will work in all situations. Be careful to always refer to the detailed information at lunduniversity/images-GDPR
Corporate Communication’s recommendations are based on the University’s interpretation of the law, so there is no one-size-fits-all approach to following the GDPR to the letter. Based on those recommendations, each person publishing an image must make a judgement in each individual case. Images are published in an official capacity. It is the University that is ultimately responsible rather than an individual.
You can remove images from the locations you know they are published in, as well as delete them from the storage locations you know they are in. Contact Corporate Communication about images to be removed from the image and media bank. However, there is no way to guarantee that all images will be removed and never used again.
Summary
According to the Higher Education Ordinance, Lund University is tasked with research, education and collaboration. To fulfil the remit effectively, we use images and videos. You must inform any person you want to photograph or film that you are doing so on behalf of Lund University and refer them to the information on how we process their personal data.
Copyright
Photographs and films are protected by copyright, which means that the author has the right to be mentioned in connection with the work. The right applies in all contexts except for when it is practically or technically impossible.
Copyright law governs your rights to use a work. The agreements with our procured photographers regulate our right to use the images we purchase. All the images we have purchased as of 1 January 2020 are free to use as much as we want within the University, and we are also free to make them available to third parties wishing to provide information about Lund University. The Image and Media Bank makes clear what rights you have to use each individual image.
Creative Commons licences
Many images online are marked with Creative Commons licences. There are different types of CC licences that individuals can use to tag their images for sharing their images with others.
In total, there are six different CC licences, each granting different permissions. The licences specify things like whether you are free to distribute the image and whether you are allowed to remix, adapt, or build on it. In simple terms, CC licences allow creators to give up parts of their copyright in various ways. In addition to the different licenses, there are also two different labels, known as Public Domain labels, which are used when the work is not covered by copyright and can therefore be used freely.
Please note that CC-labelled works do not necessarily imply consent from individuals in the images under the General Data Protection Regulation (GDPR).
About CC licences and how to use them on creativecommons.org
Contact
Corporate Communications
grafiskprofil [at] kommunikation [dot] lu [dot] se
Nina Ransmyr
Communications officer
nina [dot] ransmyr [at] kommunikation [dot] lu [dot] se
+46 46 222 03 20
Maria Wendel
Communications officer
maria [dot] wendel [at] kommunikation [dot] lu [dot] se
+46 46 222 70 07
Petra Francke
Communications officer
petra [dot] francke [at] kommunikation [dot] lu [dot] se (petra[dot]francke[at]kommunikation[dot]lu[dot]se)
+46 46 222 03 16
Anna Johnsson
Communications officer
anna_v [dot] johnsson [at] kommunikation [dot] lu [dot] se
+46 46 222 70 21
Related information
Image and media bank
Download images, templates, logos, fonts and music files from the Lund University Image and media bank.