Germany: Does The GDPR Also Apply To Photographs And Films?

Last Updated: 2 July 2018
Article by Yvonne Schäfer
Most Read Contributor in Germany, September 2019

Since May 25, 2018 at the latest, the question has arisen as to whether the new data protection provisions must be observed for a wide variety of digital applications/processes. The new data protection provisions from the European General Data Protection Regulation (GDPR) and the new German Federal Data Protection Act must always be observed when personal data is processed in non-private areas.

Processing of personal data

Photos (and films) may also contain personal data. On the one hand, the facial image is a personal datum, on the other hand, additional data such as location and time of image capture or other GPS information are frequently stored as metadata for the individual digital photos. High-resolution recordings in HD quality often also enable biometric recognition of the persons depicted. These cases are even considered particularly protected sensitive personal data (Art. 9 GDPR).

Legal basis for data processing

Any processing of personal data must be done lawfully, meaning that there must be a legal basis in accordance with Art. 6 GDPR. In this context, however, the legitimate question arises as to what role the German Act on Copyright in Works of the Fine Arts and in Photography (also referred to as the Art Copyright Act "Kunsturhebergesetz") continues to play. Will the Art Copyright Act become meaningless because of the GDPR? Or do the provisions of the Art Copyright Act apply to photographs as the more specific provisions?

The data protection supervisory authority of the state of Brandenburg has now commented on these issues (LDA Brandenburg: "Processing of personal data in case of photographs," available at: The supervisory authority clarifies that the Art Copyright Act only contains provisions for the distribution and public display of photographs. As far as the actual "photographing" activity is concerned, i.e., the production of the photograph, the Art Copyright Act does not include any provisions. In this respect, the legal basis of the GDPR must always be used, such as consent, contract performance, or legitimate interests.

Legal basis for photography

The legal basis to be considered is therefore consent under data protection law. The problem with this legal basis is, however, that the consenting party has the right to revoke the consent at any time with effect for the future. This may result in the photograph having to be deleted and no longer being permitted to be used. In addition, the GDPR requires detailed information of the data subject for the consent to be effective at all. Under this consideration, a different legal basis should be chosen if one is available.

Taking photographs may also be permitted because the person photographed has concluded a contract with the photographer about the photos. No other persons may be photographed on the basis of this contract, however.

In addition to contract performance and consent, processing (here: photographing) on the basis of overriding legitimate interests may also be considered. In this case, the interests of the parties worthy of protection must be weighed against each other. The interests of the photographer may include the wishes to pursue the professional activity, which is subject to professional or artistic freedom, or the interests of the organizer (as third-party interests) to document an event. These interests are to be weighed against the photographer's interests. The interests of the photographer depend on his or her reasonable expectations. At public or large events, the photographer must expect the event to be documented in photographs. Secret or discrediting photographs, however, will not outweigh the photographer's legitimate interests, so that such photographs predominantly cannot be taken on the basis of legitimate interests. LDA Brandenburg cites further examples, in which the photographer cannot rely on legitimate interests, such as the photographing of children and photos of persons that relate to religion, health, sex life, or the sexual orientation of the person photographed. The latter situations, like biometric data, fall under the special categories of personal data that are particularly worthy of protection under Article 9 GDPR.

Legal basis for the use of photographs

For the use of photographs, such as publishing, the Art Copyright Act could take precedence, however. Section 22 Art Copyright Act stipulates that portraits may only be distributed or publicly displayed with the consent of the person depicted. Section 23 Art Copyright Act governs situations in which, by way of exception, no consent is required, such as relating to photographs of events or if the person is only accidentally ("as an accessory" of a place) included in the photograph. It is currently unclear whether the Art Copyright Act will remain applicable alongside the GDPR.

Article 85(1) and (2) GDPR provide that the Member States must or may provide for exemptions from the GDPR for journalistic, scientific, artistic, and literary purposes to ensure freedom of expression and information. It is unclear whether Germany has so far made such provisions. According to current information, Germany has at least not notified any exception laws to the Commission. The Art Copyright Act may possibly be a legal provision under Art. 85(1) GDPR for which no notification to the Commission is required. Legal uncertainty currently exists in this respect. The Federal Ministry of the Interior, Building and Community has published a statement on this issue (available at: The independent data protection authorities, on the other hand, have not yet submitted their positions. Nor does LDA Brandenburg position itself with the above-mentioned statement. It merely holds that the use of photographs requires the consent of the person photographed or another legal basis. The exceptional provisions of Section 23 Art Copyright Act could be taken into account at least in the context of a balancing of interests when processing on the basis of justified interests, as long as no provisions to the contrary would be made.

In order to avoid legal uncertainties, it is advisable to obtain consent for the publication of personal photographs, wherever possible.

Exemptions for the press

Exceptions will at least exist for the press, because LDA Brandenburg considers the "media privilege" to still apply. For photography and distribution of photographs for journalistic-editorial purposes, the media privilege, which is governed by Section 9c and Section 52 Interstate Broadcasting Treaty on the one hand, and by various national laws on the other hand, is a provision in accordance with Art. 85(1) GDPR. The press is thus exempt from numerous provisions of the GDPR. It must be ensured, however, that only the journalistic press (e.g., newspapers or photojournalists, possibly also blogs) falls under this exemption. A corporate press department will likely not be able to invoke this exemption.

Information duties

Since personal data are processed, the information duties under Articles 13, 14 GDPR must be met. The Brandenburg Data Protection Authority recommends privacy policies to be communicated in invitations or on information signs at events. In the case of photographs with a large number of individuals, the provision of information may be disproportionate in individual cases, so that according to Art. 14(5) GDPR, in exceptional cases, no information would have to be provided. This could be conceivable in a public space where people cannot be reached, such as in the subway or in public places. In this respect, however, the individual case must always be considered.

Duties to erase

Personal data, thus also photographs depicting persons, are to be erased as soon as they are no longer required. As long as the data are necessary to enforce legal claims, however, there is no duty to erase them. The German Copyright and Related Rights Act (also referred to as Copyright Act) stipulates how long works enjoy protection. Accordingly, photographs enjoy copyrights 70 years after the death of the author, i.e., the photographer. For this period, there is no obligation to erase the data. Due to the media privilege or other statutory provisions, additional and differing duties to erase data may exist if, for example, there is a historical interest in storage of the photographs.


Personal data are involved where individuals may be identified on photographs. This means that data protection laws must be observed if photographs are not taken and published exclusively in private areas. The GDPR definitely applies to photography. It is currently unclear whether the Art Copyright Act applies primarily to the publication or other use of photographs depicting individuals. It also remains to be seen whether legislation will be passed to add simplifications. In any event, drafts for the revision of the Art Copyright Act that are known to date do not yet offer sufficient solutions to the questions raised above.

As long as the supervisory authorities and courts do not position themselves, it is currently advisable to obtain the consent of the persons photographed, wherever possible, to publish photographs and to rule out legal uncertainties. In any event, information should be provided wherever reasonably possible.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on

Click to Login as an existing user or Register so you can print this article.

Similar Articles
Relevancy Powered by MondaqAI
Some comments from our readers…
“The articles are extremely timely and highly applicable”
“I often find critical information not available elsewhere”
“As in-house counsel, Mondaq’s service is of great value”

Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
Up-coming Events Search
Font Size:
Mondaq on Twitter
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of

To Use you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions