2 July 2024
Looking at photographs through a Copyright and UK GDPR lens
Becky Hall and Sofia Carroll, our two Information Governance Managers, look at the potential copyright and data protection issues that can arise in reproducing old photographs.
If you are an organisation with a collection of old photographs, you might wonder if there are any barriers to using them online. We explain why you will need to consider both data protection and copyright legislation and suggest some next steps.
Copyright perspective – ownership
Photos qualify as “copyright works” under the Copyright, Designs and Patents Act 1988 as expressions of an idea in a visual form. Copyright is an ‘exclusive right’ granted to copyright owners that enables them to control how their works are used by others, including publishing them online. Copyright law outlines that, generally, the first owner of copyright in a photo is the person behind the lens as the creator,[1] unless it was taken by an employee in the course of their duties; then the copyright owner is the employer.[2]
The exclusive rights granted to copyright holders do not last for ever. In the UK photographs are protected by copyright for the lifetime of the photographer plus 70 years. Copyright in photographs by anonymous photographers lasts for 70 years after the photograph was taken, or first made available to the public. Therefore, identifying names and dates of death of photographers is key to deciding if a photograph is still protected by copyright. Once copyright in a photograph has expired it is in the public domain and can be used without restrictions.
If a photograph is still in copyright, you will need to have permission from the current copyright holder for you to publish the photograph online. Identifying and tracing current copyright holders in old photographs can be difficult and may require some detective work. Copyright can be inherited or bequeathed so if the photographer is dead and they owned the copyright the current copyright holder may well be their estate, or a beneficiary of their will. If the copyright was owned by an employer, you may find the company no longer exists or was bought out by another company.
You should conduct and keep a record of diligent searches to identify copyright holders, this could include:
- Checking the original photograph and any supporting documentation in your archive.
- Online searches for named photographers or employers
- Checking other online collections and commercial image licensing websites
- Contacting other archives and museums for help
Conducting reverse image searches on Google or TineyeIf you are successful in tracing a copyright holder you should make contact and discuss obtaining either
- a licence from the copyright holder, outlining how you may use their work. or
- the transfer of the ownership of the copyright to you,
A photograph where the copyright holder cannot be identified and / or traced is known as an ‘orphan work’. Museums and archives have millions of orphan works in their collections. Your organisation will need to take a risk-based decision on whether, or under what circumstances it might use such photographs. The record of the due diligence searches undertaken to identify the copyright holder should be used to make informed decisions
To learn more about copyright in practice, book a place for you and your team on our courses:
- Copyright Essentials (6 CPD Points, next 17 & 18 July, 9:30am-1pm)
- Copyright and Audio-Visual Content (3 CPD Points, next 25 July, 1-4:30pm) [NB: this course regards rights issues specific to broadcasts, films, scripts, music and sound recordings.]
Data protection perspective – people
All original photos will attract copyright protection, but the data protection aspect only becomes relevant if any living identifiable people feature in the shot.
To use a photo that’s already in your collection for something else, you will have to identify a relevant lawful basis under the UK GDPR. This is in addition to certifying who the copyright owner is and what you are allowed to do with the photo from an intellectual property perspective.
The usual lawful basis for using someone’s photo will be their consent, so you need to have appropriate mechanisms in place to let them know that you are planning to use the images and for what.
There are some challenges with gaining consent for using an old image, such as:
- Was any consent sought at all at the time?
- Was the consent given up to the standard of Article 7 of the UK GDPR?
- Do you hold the person’s up-to-date contact details?
It may be useful to consider the context in which the photographs were taken and if those people who feature in them would expect their images to be used in this way. For example, if the image contains children, the parents may have given their consent years ago, but the child may now be an adult who would not consent to an old photograph of themselves being used. A good example of this is Spencer Elden, 31, the naked baby on the cover of Nirvana’s famous album ‘Nevermind’ who sued the rock band for using his naked image on their album.
Book a place on our Data Protection Essentials course (6 CPD Points, next 18 & 19 September 2024, 9:30am – 1pm) to learn how to manage these challenges in your daily work.
It’s important however to highlight that while people may have information rights over their photos, there is no recognised ‘image right’ in the UK. This means you can’t control how your face is used unless you rely on other laws or contractual arrangements.
Managing copyright and data protection risks
You may have photos you want to use but sometimes you don’t have a record of their rightful owners. To ensure compliance and manage any related risks:
- Search records thoroughly to try and determine who owns the copyright.
- Reach out to the photographer to clear the rights or get a licence.
- Accept the risk of not knowing and document your decision and plan if the rights holder comes forward.
Different organisation will have different risk appetite, so you may decide to use photos without consent and/or without confirmation of copyright ownership. This may include:
- Using group shots or shots over an individual’s shoulder so that an individual isn’t the focus of the image.
- Only using the images in an in-person exhibition and not using them on social media or for marketing purposes.
- Not using photos of children at all if it’s not in their best interest.
If you choose to take a risk-based approach, you need to be aware that individuals may contact you asking for the image not to be used as they feature in it or because they are the copyright holder. We advocate for the EVA approach when there is a copyright dispute, which includes open communication and trying to resolve the issue amicably.
You may find that there is no data protection angle if the photo is from a historic period because the individuals in it will have passed away, and so data protection law won’t come into play.
Regarding consent management and marketing, some organisations decide to rely on legitimate interests to justify using photos. This is to avoid having to pull back promotional materials which can prove practically impossible once they have been printed and shared, thus making it hard for the person to meaningfully withdraw their consent for using their images.
- You need to complete a Legitimate Interest Assessment before you use the images.
To understand how to obtain valid consent for marketing purposes, attend our Lawful Marketing and Consent (PECR and UKGDPR) course (3 CPD Points, next on 31 July, 9:30am-1pm).
Naomi Korn Associates can provide tailored support with rights clearance and any data protection concerns you have. Please contact us at info@naomikorn.com.
[1] Copyright, Designs and Patents Act 1988 (CDPA), s 9(1) and Copyright Act 1911, s5(1)(a)
[2] CDPA, s(11)(2) and CA s5(1)(b)