gdpr england-and-wales data-ownership subject-access-request data-protection-act
Access rights to professional photographs
<p>An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these photographed subjects turns around and subject-access-requests their photo under the Data Protection Act.</p>
<p>Are there intellectual property / creative work / other exemptions that may apply that would allow the photographer to insist on charging for access to the work? Or is the subject entitled to (even full resolution) versions of the photos?</p>

<p><a href="/questions/tagged/australia" class="post-tag" title="show questions tagged &#39;australia&#39;" aria-label="show questions tagged &#39;australia&#39;" rel="tag" aria-labelledby="tag-australia-tooltip-container">australia</a></p>
<h2>You must be given <a href="https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/access-your-personal-information" rel="nofollow noreferrer">access</a></h2>
<p>The organisation may charge a reasonable administration fee for this.</p>
<p>They may impose a licence on copyrighted materials such as prohibiting use other than verifying the information held and they you must destroy it once that purpose is accomplished.</p>
<p>So, yes, you can <em>get</em> the photo but you can’t practically <em>use</em> the photo</p>

<h2>The photograph committed a felony in <a href="/questions/tagged/germany" class="post-tag" title="show questions tagged &#39;germany&#39;" aria-label="show questions tagged &#39;germany&#39;" rel="tag" aria-labelledby="tag-germany-tooltip-container">germany</a></h2>
<p>Making photos of a person in Germany and then offering to sell it to them is considered <em>Nötigung</em> in Germany, which is a felony, and a violation of the identity rights of the photo subject.</p>
<h2>The GDPR requires access.</h2>
<p>The photo of the subject is data about the data subject, so it has to be given via GDPR unless it is destroyed before the request is given. There's no requirement for a lack of a watermark or a resolution that is better than required to recognize it is the data subject.</p>
