Is GDPR consent as part of Terms & Conditions valid?

Question

In the terms and conditions of the kite festival consent for use of footage of the audience is written into the Terms & Conditions:

5.c: Ticket Holders consent to being photographed, filmed and sound recorded as an audience without payment, and to their image being exploited in any and all media for any purpose at any time throughout the world by the Promoters who shall own the copyright in all such recordings. If you attend the Event with a child under 16 you give the foregoing your express consent on their behalf.

Note that consent is implicit, with no instructions given for withdrawal of consent. From the ICO site:

What is valid consent?

• Consent must be freely given; this means giving people genuine ongoing choice and control over how you use their data.

• Consent should be obvious and require a positive action to opt in. Consent requests must be prominent, unbundled from other terms and conditions, concise and easy to understand, and user-friendly.

• Consent must specifically cover the controller’s name, the purposes of the processing and the types of processing activity.

• Explicit consent must be expressly confirmed in words, rather than by any other positive action.

This seems to miss most if not all of these points (note "the Promoters" are not specifically defined in that document, but is "U-Live Portfolio Ltd and any associated promoter(s) of the Event").

Is this legal consent? I assume that if they used the 9.b. right to refuse you entry after you withdrew consent that would be illegal? In the privacy policy they detail the results of withdrawing consent for marketing communications but not for this photography and recording.

Answer 1

Consent in the GDPR sense? No. Consent in the more general sense of “agreement”? Sure.

Under the GDPR, consent is only one of many legal bases for processing personal data.

Consent requires an unambiguous indication of the data subject's wishes through a clear statement or affirmative action. Thus, consent cannot be “hidden” in another document – it would be ambiguous whether the data subject just wanted to agree to boilerplate terms of service or specifically consent to a particular purpose of processing. Indeed, Art 7(2) GDPR explicitly requires that “the request for consent shall be presented in a manner which is clearly distinguishable from the other matters”.

Another legal basis is Art 6(1)(f) legitimate interest. A legitimate interest requires some interest that outweighs the data subject's rights and interests. This balancing test must consider whether the data subject can reasonably expect the processing to occur, given the data subject's relationship with the data controller.

I would argue that an event venue does have a legitimate interest to film and photograph events, and that this interest outweighs the data subject's rights and interests at least for larger shots, but not necessarily for close-ups, portraits, etc. The event participants can reasonably expect the audience to be filmed and photographed.

Indeed, the linked privacy policy (linked just after the part that you quoted) is very thorough and explains in detail what is happening. The table starting on page 9 describes the purposes of processing, the data being used for that purpose, and the legal basis for that purpose. Here, the relevant entry is:

Purpose: Photographs of crowds at our festivals and/or events

Type of data: (a) Identity

Legal basis: (a) Necessary for our legitimate interests (to capture footage of artists performing at our festivals and events which feature crowd or to record images of our festivals and events for showreel and marketing purposes)

This means: they are not asking for consent in the GDPR sense. They are relying on a “legitimate interest” instead. They have to inform you in advance about the processing of personal data – which they evidently did by providing the privacy notice – but they don't have to ask you.

So what is that consent about then? The consent you quoted is more about personality rights: you would consent to “being photographed, filmed and sound recorded as an audience without payment, and to [your] image being exploited in any and all media for any purpose at any time throughout the world”. This is essentially a model release.