An interesting LinkedIn post by a lawyer caught my eye the other day. At the sidelines of a public event, the lawyer took a photo of a banner that informed attendees that there was ongoing photography and videography. The banner then instructed attendees that there was a presumption of consent to be photographed or filmed for commemorative, promotional and/or marketing purposes. In the event that the attendees did not want their images captured, they were instructed to notify event staff. The lawyer’s post was quite illuminating as he proceeded to describe several reasons why that banner was in breach of the Data Privacy Act (DPA). I’ll go a step further and add that the event organizers were necessarily being called out for acting in a statutorily lazy manner. The end.

The digital age has brought incredible and life changing benefits to humankind. It has also brought with it incredible and life altering risk and compliance challenges to organizations. Who would have thought that your regular family photographer or friend who takes a photo of you and then publishes it without your permission for promotional or marketing purposes is now regulated by a statute? That they are now considered a data controller for purposes of the Act and the images so collected are subject to several limitations in terms of how long they should be retained, how the consent should be recorded and providing options for the owner of the data to withdraw such consent. Life just got very complicated for the trigger happy photographers and their event organizing employers.

Let me demonstrate why. John walks into an event where there are videographers and photographers immortalizing the happy and maybe-not-so-happy patrons. He gives a cursory glance to the banner at the entrance informing him that as soon as he crosses the threshold, he has given his consent. Please note that this is implied and not express consent. He has a drink or two or three. Before long, he thinks that the lady sitting next to him in the bar needs his attention and begins to chat her up. She accepts for him to buy her a drink or two or three.

Put on your Netflix hat here and picture how far south that scene can go. The photographer finds a handsome young man – HYM- enjoying the event and takes a vivid shot. But the photographer inadvertently captures John and his newfound plus one in a mutual discovery moment in the background of the shot. But that was not the aim of the photographer, whose lens had focused primarily on HYM. John and his newfound lady friend were just background noise and, in fact, can hardly be seen as the surrounding setting is somewhat dark. Event organizers post the picture citing what a wonderful time revelers who come to their events have. I mean, look at HYM having the time of his life. Please come for our event next month. No one can really tell that it’s John in the promotional social media blitz. Absolutely no one.  Except for, you guessed it, Mrs John who can recognize the back of John’s head even in a Kasarani stadium crowd.

John comes after the event organizers hard. “Pull down the promo pictures, I didn’t consent nyef nyef.” “Oh yes you did!” They respond. “Don’t you remember the banner at the entrance as you walked in, which banner was still up as you staggered out?” John pulls out his favoritthe internet research saved on his phone and cites Section 3 of the DPA to the event organizers. “Consent must be express, unequivocal, free, specific and informed either by a statement or clear affirmative action. Walking past a banner does not constitute express consent!”

“You may have a point,” the event organizers admit. “But our lawyer tells us that your image is really not personal data. Section 3 of the DPA says that personal data means any information related to an identified or identifiable person. To be honest, you are not identifiable.” “Are you kidding me?” John explodes. “Not identifiable?? Have you met Mrs John and her binocular eyes?!”

Look, the Data Protection Act should have any one of us organizing a training, a social event, a conference or any public gathering concerned.. If we insist on using real, natural persons we have to be ready to get their express consent and provide a clear mechanism to expressly opt out of their pictures being taken or to withdraw that express consent at a later date. It might actually just be easier to use images of human beings generated by artificial intelligence if we want to promote our events without using paid models. Or just take unidentifiable and highly blurred photos of people participating our events. Or simply just use cartoon characters instead!

X: @carolmusyoka

The Nitpicker Podcast