Introduction
As videographers our job is to capture moments at events. From the point of view of data protection, anyone in the room who is recognisable in video is an individual whose personal data has now been captured and we are now handling it.
This is the case not only for the organisation operating the camera but also the organisation who has hired the camera operator. This is why capturing video sits inside the UK GDPR and the Data Protection act 2018.
For anyone bringing in videography into a project this raises a fair question.
Does everyone who is in front of the camera lense have to agree before the camera captures anything?
The honest answer is that consent is only one of several lawful routes and on most projects the responsibility is shared between the project owner (the client) and the video services supplier (us or someone like Ken Chu Videography).
Rather than resting on any one specific person, it’s a team effort. This guide is part of our wider work on event videography explaining:
How it actually works,
When the rules apply,
Who is responsible for what,
- How signage and opt out arrangements should be handled,
- The extra care children and other vulnerable people need,
- How footage should be stored afterwards.
This is really important stuff and getting this wrong can cause a lot of problems!
Written from a professional videographer’s perspective to show how it’s handled on set, this guide offers general UK guidance rather than legal advice. For high-profile or sensitive events, seek tailored advice.
Who is responsible: the videographer’s two roles
Before we even think about putting out signs and printing out consent forms there is one question that dictates everything. As a videographer, are we acting as a data processor or a data controller? Most of the time us videographers and photographers drift between the two roles silently. We are constantly accessing the situation and the understanding of when each role is applicable is where a professional videographer or photographer shines.
When a videographer is filming for a client under their instructions they are a data processor.
Examples of this could be a company that has hired a videographer to capture a conference, or a charity has commissioned a production company to film its awards evening. The client decides why the footage exists and how it will be used. The videographer is executing a brief. As the processor it’s our job to follow the lawful instructions by keeping the footage secure and having a written agreement in place that says so.
When a videographer or photographer is making the decision about what to do with people’s images they are becoming a data controller.
An example of this is when they are using the footage in their own portfolio, showreel or social media channels.
Now the videographer or photographer is deciding what that person’s image is being used. They need their own lawful basis and their own transparency.
It becomes totally separate from the client and the original purpose of why that image was captured in the first place. This is normally sorted out via contracts and service agreements before the project starts.
The important part is where the organisers and the videographer/photographer’s responsibilities meet.
The organiser is usually the party who sets the lawful basis for filming the event and informs the attendees and participants. The videographer then works within the boundaries set by the organiser, making sure those boundaries work for the project to be successful and the video to meet its aims. Finally they make sure the footage is handled properly after the event.
Sometimes the boundaries of responsibility move depending on the size of the project. Quite often we may have a producer in our team to project manage larger shoots and that producer may take on some of the tasks around consent. For instance, they may orgainse signage in collaboration with you and the distribution of consent forms, taking the burden away from the client. It’s all part of the service if you want it!
When a videographer asks before the shoot, “Do you have consent forms ready and signage about filming visible?” and, “Are you happy for me to use some of this footage in my portfolio?”, we are asking to make sure the responsibilities are settled cleanly on both sides.
Consent is not the only lawful basis
A lot of the worry around GDPR and filming is that signed consent is always needed for everyone. This is not true. In the UK, GDPR sets out several lawful bases. In the context of events the two things that need to be considered are consent and legitimate interests. For a client event, it’s the organisers job to decide which of these are chosen. The videographer’s job is to understand which way the organiser wants to go and act accordingly.
Legitimate interests
cover most things at events. Wide shots, atmosphere, audience members reacting to a speaker. People going to an event reasonably expect to be filmed and often there is signage around the venue to let them know. Putting signs out tells people you have considered this and you are sensitive to their needs. Basically it makes you look good.
Consent
is the basis in the situation where someone is singled out. Things like interviews, pieces to camera, vox pops and any filming of children or vulnerable people. Valid consent must be received by the subject (or parent/guardian) and that should also allow them to withdraw that consent whenever they want. If that happens a videographer must remove that footage from the edit and delete the footage. This is why consent is impractical as the only basis for an event where 100s of people are attending, but ideal for the handful of people who are featuring in a video as interviewees.
As professional videographers we match the shooting style to the basis. Crowd shots sit under legitimate interests. In a situation where someone is named in a lower third title we need to get a signed release from the person who is being named.
Recently we filmed a Conference in London and the organiser had consent notices at only one of the two event rooms. It was too late to set up more signs in the second room by that point.
I flagged it to the organiser who then made sure that the people that were selected for vox pops were from the suitably signed room and not the other room. This saved a huge headache later because if we had interviewed anyone from the room with no signs we would have had to retrospectively collect consent which would have been very difficult. It’s these sorts of situations we need to avoid and anticipate as the problems it creates are difficult to unravel and have an impact on the final film.
Signage and opt out zones: what goes on the wall
Signage is the most useful GDPR tool in your arsenal. It sets out the expectations, supports the legitimate interests and gives people the choice to remove themselves if they want to. At a client event, it’s usually the organisers responsibility to get this set up, although a good videographer always asks to check it in place and provide templates to get them printed at the last minute!
It’s best for signs to be placed around the room but especially at the entrance where people might be going through registration. The signs should say that filming is happening, who is doing it and why, where footage may appear and how to opt out and ask questions about it.
Sometimes a QR code might be added to take someone to a full privacy notice online with their smart phone. This is useful as it’s not ideal to print out every detail on the sign. This privacy notice will include information about the lawful basis, how long the footage is kept for, who it is shared with and the rights people have.
Here’s a ready to share example organisers can keep on file:
Filming and Photography in Progress
Video and photography are being captured throughout [Event Name] by [Organisation] for use in marketing, social media and future promotion. By entering this area you may be filmed. If you would prefer not to appear, please speak to a member of staff at registration or email [mailto:contact@example.co.uk].
Full details: [privacy notice link or QR code].
Putting signs up doesn’t override anyone’s rights. There should always be an opt out process that is easy to follow. A common one is to have a designated seating area for anyone who opts out, so the videographer knows not to film a specific section of people. Sometimes people who opt out are given a sticker or a different colour lanyard.
For an event that is ticketed, there may be information on the ticket itself about filming that is occurring. This can happen via email as well and is advisable as a second layer.
Filming children at events
Filming people under 18 is a different matter. In these cases permission needs to be provided by a parent or guardian and the uses need to be specific rather than a blanket “any use”. We can never use a child’s full name in the titles. If the footage is being used in marketing proceed with caution.
If it’s not clear if permissions have been granted for a child in the room, this needs to be worked out before we hit the record button.
Importantly, this is all exactly the same for people in a position of vulnerability.
After the shoot: requests to be removed and storing footage
After the shoot GDPR responsibilities for all parties are still in play although they are often forgotten. People keep their data protection rights during and after an event.
It’s not uncommon for someone to change their mind and ask to be taken out of a video. Most often it’s someone who’s being interviewed and doesn’t like how they have come across or they have simply changed their mind about being involved after having some time to think about it.
It pays to keep calm at this point. When the videographer is the processor and this request has come through, let your videographer know and they will make changes to the edit. As videographers we are used to these sorts of requests so it’s not a problem.
Sometimes people ask for a copy of the footage they are in. This footage should be given within a month and deleted if they request it. The footage may need to be deleted upon their request.
The largest responsibility after the shoot with regards to GDPR is the storage of the footage after the shoot. We keep memory cards, drives and cloud storage access controlled and encrypted where possible.
Raw footage is never left on an unsecured machine or laptop. Access to footage is always limited to the people who need to work on it. When the project is over we remove copies so that it exists on only one archive drive location for one year (unless a client tells us they want it stored longer).
Holding old event footage “just in case” is a liability rather than an asset. If there is ever a breach we need to contact the Information Commissioner’s Office within 72 hours.
When the videographer is acting as a processor we need to tell the client without any delay that there has been a breach. All of this might seem over the top but it is just following a professional standard.
Questions about who owns footage and how it can be reused go alongside this and our guide to who owns your video footage covers the licensing side.
Public versus private events
When considering if an event is public or private it doesn’t change the law but to those being captured at the event the expectation changes and it’s a sliding scale. At largely public events like festivals or concerts people generally expect there to be a camera crew and they might get captured. This makes the legitimate interests basis easier to fall back on for the organiser and videographer.
At a private event people are more sensitive as they might not necessarily consider there to be filming going on. This is where organisers need to make sure processes for consent are set up and bulletproof. As mentioned, it’s a sliding scale and different contexts provide different requirements and levels of sensitivity. It’s our job to read the room and together with the organising client, make the right judgement.
What to look for in a videographer who takes this seriously
When you are booking someone to film your event, listen to the way they talk about consent. This will tell you a lot.
An experienced videographer will ask about.
During pre-production and initial calls before the shoot they will ask questions about:
- What GDPR processes are in place?
- Is signage being organised?
- Are there any children in attendance?
- Can any of the footage be used in their portfolio?
Just remember that they aren’t asking these questions to trip you up or challenge you. A professional and experienced videographer knows that getting this wrong can open a giant can of worms. In fact they are looking out for you and your event’s guests. So if a videographer is asking these questions, recognise that you have a good one!
A quick checklist for event filming
- Confirm identifiable people will be filmed, so GDPR applies
- Agree the lawful basis for general filming, usually the organiser's legitimate interests, and back it with signage
- Put releases in place for anyone filmed close up or interviewed
- Settle portfolio and showreel use in writing, at booking
- Arrange parental permission and safeguards for any children
- Provide signage at entrances and an opt out zone for those who prefer it
- Agree a simple route for people who ask not to appear or to be removed
- Store footage securely, with limited access and a set retention period
- Know the 72 hour breach reporting rule and have storage locked down so it never applies
Frequently Asked Questions
Do I need signed consent from everyone at my event?
No, not everyone. If they are being interviewed, filmed close up for a longer period of time or are being tagged in the film with a name or lower third title then the subject needs to sign a release. If they are part of a crowd it’s considered general coverage and signage in the room about filming is all that’s needed.
Whose job is consent and signage, the organiser's or the videographer's?
It’s usually the organisers job to put up the signage. When a videographer is fulfilling your brief they are acting on your instructions as a data processor, so the organiser needs to set the lawful basis and let the event’s guests know. An experienced videographer will be pestering you to make sure it’s done. That’s their job.
Can a videographer use footage of my event in their showreel?
If you have granted them permission to do so, then yes. These requests normally come as part of the contact or service agreement.
What happens if someone asks to be removed from the footage?
If you receive a request like this it should be simple to process. Let your videographer know and they will remove that person from the edit and delete the footage if it’s requested.
What about filming children and vulnerable people?
Children and vulnerable people should be treated as sensitive. A parent or guardian’s permission is needed in these cases. Extra caution should be applied if footage is used in marketing.
Final Thoughts
Filming at events in the UK is entirely workable within the rules. The point is not to make anyone nervous with a camera, but to make sure the people in front of it know what is happening and have a say.
Settle the lawful basis and who holds it, make it clear through signage and an opt out, take extra care with children and sensitive settings, and store the footage responsibly. Handled that way, data protection is not a hurdle; it is part of what a professional videographer brings to the day.
GDPR is mostly about making people aware that it is being considered for their benefit so they feel safe that the law is being followed and that they have a say. It boils down to settling the lawful bass and who holds it, make what you are doing clear though signage, be extra careful with children and vulnerable people and after the event make sure the footage is handled appropriately.
From a videographer’s point of view this is part of the job and is never considered a hassle and discussions about this is always welcomed.
This article is general guidance on UK data protection for events and is not legal advice. For your own contracts and specific situations, consult the ICO’s guidance or a qualified data protection professional.
