Guest photos and GDPR at weddings and events in the EU and UK

A photo can be personal data. The UK Information Commissioner’s Office (ICO) puts it simply in its advice on taking photographs: “If someone can be recognised from a photograph it’s usually considered their personal data.”

Personal and family life is treated differently. Article 2(2)(c) of the GDPR says the Regulation does not apply to the processing of personal data “by a natural person in the course of a purely personal or household activity”. Recital 18 adds that such activities “could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities”.

The Irish Data Protection Commission (DPC) explains the limits in its FAQ on the household exemption: “This applies as long as the personal data is not used in connection with a professional or commercial activity or made publicly available.” In a blog post on photos at events, it sums up the practical point: “taking a photo in public is generally fine; it’s what you do with that photo that can potentially become a data protection issue.”

The UK has the same exemption in Article 2(2)(a) of the UK GDPR. The ICO’s guide to the data protection exemptions says that “if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the UK GDPR.”

Two things follow from those sources:

• The exemption covers the person taking and sharing photos for private reasons. It does not cover the companies that provide the tools. Recital 18 says the Regulation “applies to controllers or processors which provide the means for processing personal data for such personal or household activities”. FotoDrop therefore keeps its own data-protection obligations, whatever kind of event you hold.
• Courts read the exemption narrowly. In Lindqvist (C-101/01), decided under the earlier Data Protection Directive whose exemption the GDPR carries forward, the Court of Justice of the EU said it covers only activities in the course of private or family life, “which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people”. In Ryneš (C-212/13) the Court stressed that only “purely” personal or household activity is covered. Posting photos publicly, or using them for a business, can therefore take them outside the exemption. Whether that applies to you depends on the facts, which is where a regulator or a lawyer can help.

Some gatherings feel private but are run by an organisation: a company party, a club dinner, a charity gala or an event a venue hosts for its customers. The DPC’s answer on promotional photos at public events, written for organisers who take photos to promote an event, says that at large events “it is advisable to have written notices in place advising attendees of the intention to take photos, the purpose of taking the photo and the intended use of the image”, and that at smaller events it is advisable to seek the consent of those attending.

FotoDrop’s privacy notice says that a professional host must give attendees its own appropriate privacy information. Where an organisation or professional host acts as the controller (the party that decides why and how the photos are used), FotoDrop processes the album content on its behalf under the Event Data Processing Addendum. If that describes your event, read those documents and the regulators’ guidance before you share an album.

Whatever the law requires for your event, guests appreciate knowing what will happen to their photos and to photos of them. A short, clear note answers most questions before anyone has to ask.

• Say that there will be a shared album, how guests add photos and who will see them.
• Explain how to ask not to be photographed, and how to ask for a photo to be removed.
• Repeat the message where people take photos: on a sign by the QR code, or in a word from whoever hosts the evening.
• Ask guests to keep photos of other people off public social media unless those people agree.

Sample wording for an invitation

“We’ll have a shared photo album for the day. You can add your photos by scanning a QR code, and we’ll share the album link only with our guests. If you’d rather not appear in shared photos, just let us know. If you see a photo of yourself that you’d like removed, tell us and we’ll take it down.”

Sample wording for a sign

“Photos welcome. Scan the code to add yours to our guest album. We share it only with our guests. Prefer not to be photographed, or want a photo removed? Speak to [name].”

Sample wording about children

“Please check with parents before sharing photos where their children are the focus, and please don’t post photos of other people’s children publicly.”

Replace the brackets with your own details and adjust the tone to suit your event. These samples are a courtesy to your guests. They are not a consent form and not a legal notice.

Privacy for a guest album comes down to who has the link and what they can do with it. Sharing the link only with guests is a sensible courtesy, but it does not by itself decide whether the household exemption applies to you: a link without a password can be forwarded, and anyone who receives it can open the album.

Guests open the album in their browser without installing an app or creating an account. By default, people with the shared link or QR code can view its photos while the album is active. A link can be forwarded, and recipients can save copies.

• Share the link and QR code through the channels you already use for guests, such as the invitation, a group chat or a sign at the venue. Avoid posting it on public social media.
• Album pages tell search engines not to index them, so an album is not meant to appear in search results. That is not access control: anyone with the link can still open an album that has no password.
• When you create the album, you can add an optional password. Guests then need the password as well as the link.
• When you create the album, you can also turn on optional browser-side encryption for photos. Your guests’ browsers then encrypt photos before uploading them, and the complete sharing link carries the key. FotoDrop keeps recovery information so you can get the key back, which means FotoDrop could technically recover it too.
• As the host, you sign in by email to manage the album, and you can delete photos from it.

Album details and uploaded photos on FotoDrop.eu use Cloudflare storage restricted to the EU. Email delivery, network handling, support, logs, caches, visit measurement and backups have their own processing arrangements and may involve locations outside the EU. The privacy notice covers who processes what and where.

Children appear in almost every family celebration, and their parents decide very differently about photos. The DPC’s blog on photos at events treats families who take photos at events for their own memories, without intending to post or publish them, as covered by the household exemption. It also notes that Recital 18 allows for social networking. It adds that if a parent asks for a photo of their child to be taken down from social media, “common sense and indeed common courtesy would suggest that you should take the photo down”. The ICO’s blog on taking photographs makes a similar point about posts among friends: “the law doesn’t cover private social media posts shared with friends and family.”

Practical steps that respect families:

• Ask parents in advance, or in the invitation, whether they are happy for their children to appear in the shared album.
• Give parents a private way to tell you that a child must not be photographed or shared. Some families have serious reasons they may not want to explain.
• Ask guests not to post photos of other people’s children publicly.
• Look through the album after the event and delete any photo a parent has asked you to remove.

FotoDrop’s terms say that direct guest use is intended for people aged 16 or over. Guests under 16 should not upload on their own; a parent can add the family’s photos instead.

A quick, friendly response is usually best. Sign in to album management and delete the photo. Deleting it from the album does not reach copies that guests have already saved to their own phones or posted elsewhere, so ask anyone who may have a copy to delete it too.

The privacy notice says that people can contact either the host or FotoDrop about content concerning them. If someone contacts you, you can deal with it straight away as the album’s host.

This guide is not legal advice. The rules apply to the facts of each event, and national laws add their own details. For authoritative information, start with the regulators:

• the Irish Data Protection Commission, for the household exemption and photos at events;
• the UK Information Commissioner’s Office, for the UK GDPR and its exemptions;
• the text of the GDPR on EUR-Lex, for Article 2 and Recital 18.

If you hold your event in another EU country, its own data-protection authority may publish guidance in your guests’ language.