GDPR: What’s it got to do with me?

GDPR and video production. Unless you've been living under a rock, you've heard about data protection. But what is the impact on brand film and video production? Moving Image asked Tom Broster of Briffa to explain.

The GDPR became law in May 2018. You need to review how you get consent from interviewees, and what to do if they withdraw consent after you have published the video.

We've covered the headlines below. For the full picture, click or tap here to download the Moving Image guide to GDPR for video producers.

GDPR and video production essentials

The GDPR came into force on 25th May 2018. It is much stricter than current regulations.

1. Video professionals need to review the consent forms they use with anyone who appears on screen.
2. An individual can withdraw their consent to appear in a film, even if they originally gave it.
3. Video professionals may have a legitimate interest to use video of an individual even without their consent.
4. It’s important to be able to demonstrate you have considered the impact of a person appearing in your film.
5. You should review your privacy policy and make sure it’s available.

What is GDPR?

The General Data Protection Regulation (or GDPR) is a hot topic. It is billed as a regulation which is set to change the data protection and privacy landscape significantly.

The GDPR will affect every sector, including any business using video in its marketing, profiling and branding.

Now is the time when those businesses should be thinking about what the GDPR means for them, and how the operation of that business should change in order to ensure compliance.

The GDPR relates to way in which businesses control and process “personal data”. Personal data has a broad scope. Individuals who can be identified in video footage, for example, will benefit from rights relating to that “personal data”. Businesses controlling and processing that data must also only do so on a lawful basis.

Consent

The concept of processing data on the basis of having explicit “consent” from an individual is not new. However, the manner in which such consent is validly obtained will change significantly under the GDPR.  Businesses must think about whether or not the consent they have from individuals is sufficient and adequate to comply with GDPR requirements.

Businesses should, however, be aware that “consent” is not the only lawful ground for processing. There are various other ways individual personal data can be controlled and processed without explicit consent of the individual.

We think the key ground will be the “legitimate interest”. In other words, is processing a viewer's data in the legitimate interest of the business? If businesses can demonstrate that they have a legitimate interest, most processing will remain lawful even without having explicit consent. This will be particularly important for those using video content.

To download the guide and get the full picture, click or tap here.