Mark Gorman, commissioning manager and Jennifer Illinesi, multimedia projects officer, Girlguiding Visit the CharityComms website to view slides from past events, see what events we have coming up and to check out what else we do: www.charitycomms.org.uk

1. Photography:
staying on the right side of the law
and protecting your subjects
Mark Gorman – Commissioning Manager
Jenny Illinesi – Multimedia Projects Officer

2. Who are we?
We are not solicitors!
Mark Gorman
• 10 years working in public and not-for profit sector comms
• 5 years leading creative service teams
• Account management background (no discernible creative skills)
• Keen runner
Jenny Illinesi
• 4 years’ experience delivering multimedia comms
• Expert in video production
• Managed to tackle complexities of GDPR whilst only swearing once

3. What is your understanding of GDPR?
GDPR
Who knows what GDPR stands for?

4. What is your understanding of GDPR?
GDPR
Who knows what GDPR stands for?
• General Data Protection Regulation
When did GDPR come into effect?

5. What is your understanding of GDPR?
GDPR
Who knows what GDPR stands for?
• General Data Protection Regulation
When did GDPR come into effect?
• 25 May 2018
Who enforces GDPR?

6. What is your understanding of GDPR?
GDPR
Who knows what GDPR stands for?
• General Data Protection Regulation
When did GDPR come into effect?
• 25 May 2018
Who enforces GDPR?
• The Information Commissioner's Office
Can anyone explain some of the big changes of GDPR?

7. What is your understanding of GDPR?
GDPR
Who knows what GDPR stands for?
• General Data Protection Regulation
When did GDPR come into effect?
• 25 May 2018
Who enforces GDPR?
• The Information Commissioner's Office
Can anyone explain some of the big changes of GDPR?
• There are new rights for people to access the information companies hold about them
• Obligations for better data management for businesses
• And a new regime of fines

8. • Consent & permissions
• Storage
• Right to be forgotten
• Expiry date
• Archiving
GDPR – Key considerations

9. • Didn’t think it would affect photography
• Consent process – bad even by pre-GDPR standards
• Storage - all over the place
• Usage - not tracked at all
• Process – not fit for purpose
Girlguiding – pre-GDPR

10. How did we feel?

11. How did we interpret GDPR?
• Identifiable imagery = personal data
• What
classes as
identifiable?
• Risk averse
– under 18s

12. Damage control
• Data cleanse
• Audit current assets
• Limit access and usage
• Agree transition period
What steps did we take?

13. Moving forward…
• Agree new process
• Plan to replenish photography
What steps did we take?

14. • Consent is gathered from each person for each shoot
• Specific permissions for usage – we have 5
• Invest in a new digital asset management system
• Track who is in each image and how each image is used
• 3-year limit on retaining data
• Archiving - TBC
What decisions did we take?

15. Some practicalities:
• Secure consent in advance where it is possible
• Large events – different process
• Take headshots at the beginning of each shoot
• Quality not quantity
• Creative approaches so consent isn’t needed
• Post-shoot
• Replace old photography
Our processes

16. • Remember the key considerations
(consent, storage, right to be forgotten, expiry date)
• Do a data cleanse
• Do a data audit
• Agree a transition period
• Agree a new compliant system – think about resources
• Get consent in advance
• Quality over quantity
• Stagger replacing old photography
Top tips

17. Now…

18. The power of human stories:
how to be an authentic storyteller
28 February 2019
London
#CharityStories

19. Visit the CharityComms website to view
slides from past events, see what events
we have coming up and to check out
what else we do:
www.charitycomms.org.uk