Photographing People in Your Business

Most businesses assume that because they own the building, they can photograph whoever is inside it and use the pictures however they like.

It is their pub, their restaurant, their shop, their gym. Their walls. So it must be their call.

It is not, and the reason is not the one people expect.

This is not really about privacy. It is about data

The word people reach for is privacy, and it muddies the issue, because privacy sounds like a matter of opinion.

The law is more specific than that. If a person can be identified in a photograph, that photograph is their personal data, under UK GDPR and the Data Protection Act 2018. It sits in the same legal category as their name, their address or their email.

Using their personal data to promote your business is processing it. Processing personal data requires a lawful basis. That is not a guideline, and it applies to the smallest café in Suffolk exactly as it applies to a national chain.

But they walked into my pub

They did, and it changes nothing.

Somebody coming into your business consents to being in your business. They do not, by walking through the door, consent to appearing on your website, in your brochure, or on your social media.

The test that matters is whether a person would reasonably expect to be used in your marketing. Someone having a quiet lunch would not. Neither would somebody at the gym, in a salon chair, or at the bar with friends. They came in as a customer, not as a model.

Being on private property does not remove that. If anything, people expect more discretion inside a business than out on the street, not less.

What you actually need

If people are identifiable in images you intend to use commercially, you need their consent, and it needs to be real consent.

Under UK GDPR that means it has to be:

• Freely given. Not a condition of service, and not extracted while somebody is halfway through their dinner and would rather agree than make a scene.
• Specific. Consent for one use is not consent for another. Agreeing to appear on your Instagram is not agreeing to appear on a billboard.
• Informed. They have to know who is taking the picture, what it is for, and where it will end up.
• Recorded. If you cannot show that you obtained it, you effectively did not.

A model release is how this is done. It is a short written agreement, signed at the time, setting out who is in the image, what it can be used for, and for how long.

It is not a formality and it is not something to sort out afterwards. Chasing somebody for a signature three weeks later, when the image is already on your homepage, is not consent. It is an apology.

Consent can be withdrawn

This is the part almost nobody knows.

Someone who agreed to appear in your marketing can change their mind. They can ask you to stop using their image, and in most circumstances you have to.

That is a real operational problem if their face is in the header of your website, printed in five thousand brochures, and on a banner outside the building. It is worth thinking about before you commit an image to something expensive, rather than after.

Children

Extra care, always. Nobody under 18 should be identifiable in commercial images without the consent of a parent or legal guardian, given properly and in writing.

This is not an area to be relaxed about, and a verbal yes from somebody at the next table is worth nothing at all.

Your staff are not automatically fair game either

Your team did not consent to being in your marketing by accepting a job.

Staff images generally need the same treatment. They should know what is being taken, understand where it is going, and agree to it. And because there is a power imbalance between an employer and an employee, consent that was not really free is not consent at all.

There is a practical wrinkle here too. Staff leave. If somebody who left on bad terms is still the face of your homepage two years later, that is a conversation nobody wants to have.

The part that should concern you most

The legal responsibility sits with your business, not with your photographer.

You are the one publishing the images. You are the one using them to promote a commercial operation. In data protection terms your business is the controller, and if a customer complains, or reports it, it is your problem to answer for.

The photographer walks away with a fee. You are the one holding the website.

That is why I raise this before a shoot rather than after, and why I would rather lose a morning’s work than hand a client a folder of images they cannot legally use.

How I work around it

None of this means you cannot have people in your images. It means you have to plan for it.

Shoot out of hours. The simplest solution and often the best one. No customers in the building, no problem to solve. I photographed The Plough at Wangford for Adnams this way: interiors, food and publicity images, with the pub empty.

Or plan a proper people shoot. If you want images with customers in them, and they can be worth having, then it gets arranged. The people in the frame are there knowingly, they have been told what the images are for, and the releases are signed before anyone lifts a glass. It takes a bit more organising and it produces images you can actually use.

What I will not do is turn up on a busy Saturday, photograph whoever happens to be sitting there, and leave you to find out later that you cannot use half of it.

If you are not sure

Ask. It is a five-minute conversation and it is a great deal cheaper than the alternative.

None of this is legal advice, and I am not a lawyer. It is how I work, and it is what I would want a photographer to tell me. If your situation is complicated you should take proper advice. The Information Commissioner’s Office publishes guidance for small organisations and it is written in plain English.

If you are planning a shoot at your business and you want to talk through how to handle the people side of it, get in touch. You can also read more about my commercial photography.