Portraits – Special categories of personal data or artistic expression?

Portraits – Special categories of personal data or artistic expression?

It happens all the time and it seems to be completely normal and perfectly all right. You go to a festival or visit a club and the next day you see your own face on the Facebook page dedicated to the event or run by the establishment. Or you have been to a friend’s wedding and sometime later, pictures of you show up on the wedding photographer’s website. These pictures, once published on the internet, may stay there for a literally unlimited time. Do you have to accept this as a simple fact of life or is there anything you can or should be able to do about it? Portraits, after all, in principle qualify as special categories of personal data in the sense of the GDPR and in intellectual property law there are definite regulations on portrait rights.

At the other end of the spectrum, photographers of course have the freedom of artistic expression, which is the right of (in this case) photographers to produce art according to their own insight without censorship and free from social interference.

In this blog, we will explore the legal background of picture publishing when it involves the portrayal of real, natural persons. So, the key question is, what makes publication of such photographs legal or illegitimate in the context of the GDPR and intellectual property law? To answer this question, we will first have to look at the legal positions of the persons portrayed in these pictures and the person doing the portraying, i.e. the photographer, from a GDPR-legal perspective. Next, we will briefly discuss the balancing of interests in the IP-legal domain, i.e. the context of Intellectual Property, specifically portrait rights. Finally, we will add things up and do the legal math in trying to answer the overriding question.

Portraits from a GDPR perspective

Principally, portraits are personal data in the sense of the GDPR if the person portrayed is directly or indirectly identifiable. Portraits may even fall under the heading of special categories of personal data whenever a person’s ethnic background, race or religion is deductible. Which, in the case of portraits, is not unlikely. So, it is fair to say that portraits usually if not almost invariably qualify as ‘special’ personal data, for the processing of which very strict rules apply – stricter than those applying to ‘normal’ personal data.

In fact, processing special categories of personal data is only allowed on condition of the existence of one of a number of legitimate bases, including consent from the data subject who, however, retains the right to withdraw previously given consent. And upon such withdrawal of consent, the portrait has to be removed unless there is another legitimate basis for its continued use. One of these conditions legitimising processing in the absence of consent is ‘justified interest’ as specified in Article 6(1)(f) GDPR. This includes the freedom of artistic expression as enjoyed by a photographer. If a photographer then, is able to sufficiently demonstrate that his work qualifies as a form of artistic expression, his or her interest will override that of the person in the picture. This concept of ‘justified interest’ is an open standard to be assessed individually in each specific case. There will have to be a balancing of interests – the right to privacy of the person portrayed on the one hand and the photographer’s freedom of artistic expression on the other.

Portrait rights and intellectual property

According to IP law, portrait rights entitle a person to object to the publication of a portrait depicting them, where the term portrait applies if the person is depicted recognisably. This is not restricted to photographs. Drawings and cartoons may also qualify as portraits, as can be true of images showing only a part of the person’s face if the person is still uniquely recognisable. In all of this, recognisability is about whether a person can, in the depiction, be recognised by family members, friends, acquaintances, etc.

The requirement of consent as a legitimate basis for publication applies to portraits as well. If the portrait has been commissioned by the person in it, his or her consent is always required for publication. In all other cases, for instance in relation to a photograph of audience members at a music festival, consent from the person(s) portrayed is not required. In other words, the photographer is free to publish the picture as he or she chooses, unless a person portrayed has justified interests outweighing the photographer’s right to publish.

These justified or ‘reasonable’ interests of the person portrayed can relate to commercial benefits or damages – as in lost advertising revenue – but they may also be of a privacy nature. If persons portrayed in a picture published on the internet want to have the image removed, they have to demonstrate damage to their justified interests and the causes of such damage.

On the other hand, there is the freedom of artistic expression, based on the general principle of freedom of expression. If a case goes to trial, the court will have to balance the justified interests of the person portrayed against the photographer’s freedom of artistic expression.


The above shows the importance of consent, or the lack thereof, as a recurring theme in determining the legitimacy, or lack thereof, of a photograph’s publication. In the GDPR, portraits are qualified as personal data, with identifiability as a key decider, similar to the identifiability criterion of IP legislation.

And both in terms of data protection and in the context of intellectual property, it is true that, in case of a dispute going to court, judges will have to balance the interests of both parties, the photographer’s freedom of artistic expression and the right to privacy of the person portrayed.

This does not mean that an appeal on the GDPR will always result in the same outcome as an appeal on IP-legal portrait rights. Recently, for instance, there was a case in which a female plaintive objected to a sound bite featuring her voice being used in the context of a theatre performance. Here, the court ruled that voices do not qualify as portraits in the sense of IP law, because they are not visual representations of a person’s face, meaning that the IP-legal concept of portrait is inapplicable. The court, however, did decide in favour of GDPR applicability because voices, in the court’s opinion, do qualify as – biometric – personal data. In other words, in this case the GDPR-legal standard was found to have a wider reach than the IP-legal portrait rights. Unfortunately for the plaintive, the court also ruled that processing the sound bite as part of a theatrical performance exclusively served the purpose of artistic expression and as such, was justified in the sense of Article 6(1)(f) GDPR.

In conclusion then, this would suggest that the GDPR offers more procedural leeway when it comes to objections against specific forms of portrait processing. What also seems clear, however, is that the data subject’s rights will not easily override the privileges of artists in the performance of their freedom of expression. There will have to be seriously significant interests involved for the rights of a person photographed to outweigh those of the photographer.

Darinka Zarić

Darinka Zarić

Darinka Zarić is a legal counsel at The Privacy Factory. Legal issues regarding the digital society appeal to her. Especially in the field of Privacy Law and the use of big data. She is currently following the master Internet, Intellectual Property and IT-Law at the Vrije Universiteit Amsterdam.

Recent publications

Privacy Weekly

Subscribe to Privacy Weekly and stay up to date on recent privacy trends and developments.

In search of

Free GDPR|Check

Connect with us

Subscribe to Privacy Weekly

Subscribe to Privacy Weekly
A privacy alert, blog post or white paper in your inbox every Thursday!

We use only functional and analytical cookies to ensure that we give you the best experience on our website. This means that our cookies do not collect personal data. Learn more.