top of page

The PAGB: Data Protection - Images of People


Implementation of the EU-GDPR and the Data Protection Act 2018 are complete. One issue of relevance to Club photographers has been considered in detail.
Is it legitimate to take and store images of people, taken in a public place, and to show them at Club, Federation or PAGB events, or in Exhibitions?

Club photographers wish to take, manage and publish their work in photographic events, including use of web sites and social media. For such photographers, the latest data protection legislation does not bar the taking, storing and exhibiting of images which include people, and there is no effective change from the 1998 legislation.

  • The taking, processing and storing of images are excluded from data protection by the personal and domestic exemption.(1)

  • The exhibiting (publishing) of images is covered by the rights of artistic purpose and freedom of expression.(2)


Nevertheless, photographers should be sensitive to directly expressed objections from individuals being included in images taken in a public place. Whilst those using a phone are probably taking pictures for personal use, someone using a larger camera may be assumed to be professional. Denial takes time and may frustrate the photographer’s purpose.
Photographers should be mindful of situations where a person may have an expectation of privacy even in a public place, or where an image might imply denigration of the subject. (3)



This opinion does not cover areas where either full data protection or some other situation applies. As examples:

  • When an image is taken for a business purpose and may be sold eg, via a web site, or the image may be licenced to another business, or via an image library.

  • When an image is taken to record a crime, and if the image is provided to the police or media.

  • When certain types of image may be prohibited by separate legislation at any stage of taking, storing or publishing. For examples, images considered indecent, or when the photographer is in a restricted location.

  • In jurisdictions outside the UK.



1. EU-GDPR (Article 2(2(c))), where this continues the provisions of the Data Protection Act 1998 (Section 36).
2. EU-GDPR (Article 85(2)), Data Protection Act 2018 (Schedule 2 Part 5), where these continue the provisions of the Data Protection Act 1998 (Sections 3 and 32).
3. ‘Editors Code of Practice’. Independent Press Standards Organisation.  


Executive Approved – February 2019

bottom of page