Smile for the camera
“What I like about photographs is that they capture a moment that’s gone forever, impossible to reproduce.” – Karl Lagerfeld
There is no argument that a moment in time can be impossible to reproduce. The same can’t be said about the photograph of that moment and if that photograph captures an individual, that image can potentially constitute the individual’s personal information which can trigger the privacy obligations in the Information Privacy Act 2009 (IP Act).
Agencies often wish to capture video footage or photographs at events they hold to use for marketing and promotional purposes. A common misconception is that privacy will prevent this from occurring. While the privacy principles govern the protection, collection and use of personal information, they don’t stop legitimate use and publication of the personal information.
Not all photographs are personal information
Personal information is any information about an individual whose identity is apparent, or can be reasonably ascertained. If an individual’s identity is apparent, or can reasonably be ascertained, from a photograph or other image, the individual will obtain the privacy protections in the IP Act.
In itself, a photograph of an individual will rarely identify the individual. What a photograph can do is provide a visual association with an identified person. We can recognise a photograph of a famous movie actor for example, because previously, a similar photograph was accompanied by identifying information.
It follows that if the photograph of an individual does not trigger that recognition, it will not constitute the personal information of that individual. Some factors that can prevent that recognition are physical, such as the size and/or quality of the image or that the photograph only partly captures the individual.
Photography at events
The privacy principles govern the agency’s collection, storage, use and disclosure of personal information. Before photographs are taken at an event, agencies should have an idea of the types of photographs required and how and when those photographs will be published.
Information Privacy Principle 2 and National Privacy Principle 1 require that an agency must take reasonable steps to ensure that when an agency photographs an individual, the individual will be generally informed about the purpose of the collection and where the photograph may be published.
This obligation can be met when organising an event by providing a ‘collection notice’ during the registration, promotion or advertising of the event, such as:
- on the webpage which contains details of the event,
- on the program agenda; or
- on a registration form or RSVP that individuals complete in order to attend.
A collection notice could also be provided during the event, by erecting clearly visible signs at the entrance to the event and/or through the delivery of a verbal collection during the opening address or start of the relevant presentation.
Publishing photographs and images online
If an agency posts photographs taken during an event on its website, there is the potential for the agency to transfer the personal information of individuals captured in these photographs out of Australia. Section 33 of the IP Act sets outs the circumstances in which an agency may transfer personal information out of Australia. One of those circumstances is where the individual has agreed to the transfer.
Agencies should note that providing a collection notice does not constitute obtaining a person’s agreement to overseas transfer. A collection notice is a way to make individuals generally aware about how their personal information will be used and disclosed. Providing a collection notice does not require that the individual agrees with the content of the notice or provide permissions for the agency’s transfer of that information outside Australia.
Obtaining the formal consent of photographed individuals provides the strongest permission. If the agency does not have a template for a photo consent form, the Queensland Government Photo Consent Form is accessible at: http://premiers.govnet.qld.gov.au/policies/imagelibrary.html
Some people, for cultural or personal reasons, may not wish to be photographed. Providing collection notices and obtaining permission as appropriate not only complies with the obligations in the IP Act, it also demonstrates respect for individual privacy and allows the individual to exercise choice over the use and publication of their image.
The agency may wish to consider mechanisms that by default allow attendees to exercise this choice. For example:
- setting up a ‘photography zone’ within the event where photographs would only be taken of people who are within that area. People who do not wish to be photographed could avoid that area; and
- providing a ‘privacy sticker’ for attendees to wear that signifies to photographers that the individual does not wish for their image to be captured.
Although this article has focused on the privacy obligations for collecting personal information and the transfer of personal information outside of Australia, the other privacy obligations of storage and security, access and amendment, use and disclosure and compliance by contracted service providers equally apply.
For further assistance, OIC has a range of guidelines that discuss how your agency can meet its privacy obligations, or you can always contact our Enquiries Service on (07) 3234 7373.