Event photography consent in Singapore: PDPA rules for hosts

Taking photos at your own family or friends’ gathering, for your own purposes, is generally outside the PDPA’s data protection obligations. Photography consent at an event in Singapore becomes a PDPA matter when an organisation, or someone acting for it, takes or publishes identifiable photos of guests, for example in a club newsletter or on a company website. Consent counts only if guests have been told the purposes, and the Personal Data Protection Commission (PDPC) gives a line in the invitation or an obvious notice at the entrance as examples of how.

This is general information from PDPC’s published guidelines, not legal advice.

Does the PDPA apply to photos taken at my event?

It depends on who holds the camera and for whom. PDPC’s Selected Topics guidelines say an identifiable image in a photo or video is personal data about that person.

A personal gathering. PDPC says an exception can apply “where the photographer is acting in his personal or domestic capacity, such as when he takes photographs or video recordings for his own personal purposes at a gathering for family and friends”. Its example: an employee photographs herself with a friend at her company’s event and posts it on her personal social media page, and is likely acting in a personal capacity. Our reading: a family party, or a home open house where you photograph relatives and friends for your own use, fits that description.

An organisation’s event. The PDPA counts companies and unincorporated bodies of persons such as associations as organisations, so a hobby club or community group is likely to be covered. An employee acting in the course of employment is not bound directly; the employer is, and the PDPA defines an employee to include a volunteer. In PDPC’s company-event example, if the company publishes the photo in its brochures or on its website for publicity, PDPC says the PDPA is likely to apply to the company, which would have to obtain the friend’s consent before publishing. PDPC adds that whether someone is acting in the course of employment “may not always be clear and may require a factual inquiry”. Our reading, not PDPC’s: if the photos will go anywhere the club controls, treat it as the club’s event, not a personal gathering.

Which three questions decide what you need to do?

This decision rule is ours, built from PDPC’s guidelines; it is not a PDPC test. Answer in order and stop when one settles the matter.

1. Is it a personal gathering? Family and friends, photos for your own use, nothing going to a club, employer or business. If yes, an individual acting in a personal or domestic capacity is not required to comply with the PDPA’s data protection obligations.
2. Will an organisation take or publish identifiable photos? A newsletter, website, social media page or brochure all count. If yes, you need guests’ consent for those purposes unless an exception applies (see the next section), so use the wording below.
3. Is a photographer hired, and is there a written contract? If the contract says the photographer acts on behalf of and for the purposes of your organisation, PDPC treats the photographer as a data intermediary who need not separately obtain consent, but you must still obtain it from guests. Without such a contract the photographer must obtain consent on or before taking the photo, unless an exception applies.

Does an event open to the public change the answer?

Possibly. PDPC says that when someone appears at an event open to the public, taking a photograph “would likely be collection of personal data that is publicly available”, for which consent is not required, although PDPC says an organisation may still wish to obtain consent as good practice. Access is the main test: the Key Concepts guidelines say the public must be able to enter with few or no restrictions, and an event entered only on payment of a fee may still count, but a restaurant booked out for a private dinner does not. The photo-taking must also be by reasonably expected means. The examples we read do not specifically cover a booked park shelter or function room, so ask the venue about its own photography rules. Our venue questions and park venue hire comparison cover the booking side.

What should an invitation line and an entrance notice say?

PDPC does not prescribe how to obtain consent. For a private client function with photos for an internal newsletter, PDPC’s example says the organisation could state in the invitation that photos will be taken for that newsletter, put an obvious notice at the reception or entrance, or print the statement on a confirmation-of-attendance form that guests sign and return. Consent in writing, or recorded so it can be found later, is good practice because the organisation may have to prove it.

The wording below follows those examples but is our adaptation, not PDPC-approved text. Name every place the photos may appear: the Key Concepts guidelines say collection, use and disclosure is limited to the purposes notified.

The opt-out and withdrawal lines are our additions; PDPC advises organisations to have a clear, easily accessible way to withdraw consent that says who, or how, to contact, which is why each names a person.

For wider publication, give more notice. In PDPC’s example of a social service agency’s retreat for clients, including children under 13, with photos going on its social media accounts, the agency assessed the likely effect on attendees, stated the purpose in an email invitation (to clients or, for those under 13, their parents or guardians) and allowed 14 days to opt out; those who did not were deemed to consent. The Key Concepts guidelines say that kind of deemed consent should not be relied on where people have no reasonable opportunity and period to opt out. Our reading, not a PDPC rule: for social media posts and photos of children, notice well before the day beats a sign on the day.

What about children and people in the background?

The background. PDPC says consent is generally required for identifiable people in the background too, but someone too small or obscured to be identified is not personal data. A tighter crop is a practical fix; that is our suggestion, not PDPC’s.

Children and teenagers. PDPC defines a minor as anyone under 21. Under 13, the organisation must obtain consent from a parent or guardian. PDPC considers that a minor aged 13 to 20 may give valid consent when the policies, including on withdrawal, are readily understandable to them, though an education setting may prefer a parent’s consent for a 13-year-old. Our suggestion: for a children’s class or holiday programme, address the invitation line to parents.

What should a hired photographer’s contract cover?

The PDPA does not require a contract with a professional photographer, but PDPC says it is good practice, and a written one is what makes the photographer a data intermediary acting for you. PDPC’s example shows the limit: a freelance videographer under such a contract later posts clips on his own webpage to promote his work. For that use he is no longer a data intermediary and needs the attendees’ consent himself.

Points to settle in writing (the first three follow PDPC’s list of what a contract may set out; the last is our suggestion):

• Each party’s responsibilities and liabilities.
• What the photographer may do on your behalf and for your purposes.
• Security and other data protection obligations.
• How files are stored, whether any photo may go in the photographer’s portfolio, and what happens to files when a guest opts out or withdraws.

What does a run of show look like with a volunteer photographer?

PDPC’s Social Service Sector guidelines follow a fictional agency’s dinner for families, with a volunteer photographer taking pictures for the newsletter; its measures could include an invitation line and a notice at reception. One guest, Mary, tells reception she does not want her photograph taken for the newsletter, so staff give her a different-coloured lanyard that lets the photographer identify her and avoid taking it. Another, Barry, initially deemed to have consented, withdraws after his photo is published; the agency must stop further publication unless an exception applies or it can mask his image. In a separate example, a volunteer’s unpublished event photos belong to the organisation, so he should not post them on his personal profile without its explicit consent.

The checklist below is ours; the lanyard, the notice and the volunteer rule come from PDPC’s examples.

Before you send invitations

• Decide where the photos will appear, and write exactly those places into the invitation line.
• Name one person to take opt-out and withdrawal messages, and put their contact in the invitation.
• Brief every photographer, volunteer or hired, in writing: where photos may be used, who has opted out, and that unpublished photos stay with the group.
• If you hire a photographer, sign the written contract first.

At the door

• Put the entrance notice where guests see it before they enter the photographed area.
• Give anyone who declines a visible marker, such as a different-colour lanyard, and tell the photographer what it means.
• Pass on any “no” that arrives after a guest has come in.

After the event

• Review before publishing; leave out or crop guests who declined and children whose parents have not agreed.
• Publish only in the places the invitation named.
• Keep the invitation and notice wording on file, so you can show what guests were told.

What happens when a guest withdraws consent after publication?

The PDPA lets people withdraw consent at any time by giving reasonable notice. PDPC’s Key Concepts guidelines set no fixed period but, as a rule of thumb, regard a withdrawal notice of at least 10 business days from the day the organisation receives it as reasonable notice; if more time is needed, telling the guest the timeframe is good practice. The organisation must tell the guest the likely consequences, must not prohibit withdrawal and must stop using or disclosing the photo unless the law requires or authorises it.

PDPC’s examples: for a client photo in an annual report, future publication stops but copies already circulated need not be recalled, and the photo may be kept subject to the retention obligation; for a group photo, the person’s image can be masked before publishing. Even where an exception such as “already publicly available” applies, PDPC says the organisation may wish to stop using the photo as good practice. Our inference: for a photo already on your own page, that would mean taking it down. The PDPA gives no right to ask an organisation to stop retaining data as such, so withdrawal need not mean deleting every copy.

Common questions