Caption Pro and GDPR

"Are we in breach of GDPR by using Caption Pro?"

Chris Emmerson avatar
Written by Chris Emmerson
Updated over a week ago

With increased concern over new privacy regulations we wanted to outline how editorial photographers and agencies who use Caption Pro to process their images might be affected.

Firstly, let’s clarify the definitions of two frequently occurring terms in the General Data Protection Regulation (GDPR); ‘personal data’ and ‘processing’.

Personal Data

Personal data is defined as any information that is related to an identified or identifiable person. The below is taken directly from Art. 4 (1) of the GDPR:

“The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social identity of these natural persons”

As you can see, it covers an incredibly broad set of information and it’s easy to become daunted by the wording. In practice, what this means for photographers and those handling images in the editorial sector, is that certain pieces of ‘data’ about someone, specifically: their likeness, (so their face in an image) their name, or their location, is considered protected information, which cannot be processed unless it is done so in a legal manner. 

Furthermore, “biometrics when used for identification purposes” (this is the information that facial recognition software such as Caption Pro relies on) requires an extra level of justification in order to process, as it is considered to be ‘special category data’. 

This brings us to our next definition, what do they mean exactly by the term ‘process’?

Processing Data 

The term 'processing' relates to:

 “the collecting, storing, modifying, retrieving, transmitting or otherwise using the personal data of an identified or identifiable individual”

Again, you’ll be forgiven for feeling a little bit overwhelmed by the broad scope of this definition. So what does it mean in practice?

When a photographer or editor takes a person’s photograph, stores that photograph, associates a person’s name with an image or distributes an image of someone through public channels, they are essentially processing someone else’s data.

By using software such as Caption Pro to identify images of people and build a private personal face database, you are then processing ‘special category data’. 

But when is all of this considered illegal?

Lawful Basis For Processing

The whole purpose of the GDPR is to outline when and how people are allowed to process people’s data. 

As such, it states that the processing of someone else’s personal data is generally prohibited unless it adheres to one of six legal bases for processing. These are as follows:

Consent, contract, legal obligations, vital interests of the data subject, public interest and legitimate interest.

The most obvious one that stands out there is consent. If you have the person’s explicit consent, there is very little to worry about.

Photographers often record this consent by way of a model release form, but with editorial, sports, press and celebrity photography it is rarely possible to garner such consent.

Does this mean that photographers and editors in those industries are all in breach of the GDPR by continuing their work without a model release form? No. 

In some cases, the ‘public interest’ basis for processing may be relevant, where:

 “processing is necessary for the performance of a task carried out in the public interest”

However, more often than not, for photographers and editors in these sectors the relevant basis for processing will be ‘legitimate interest’.

Legitimate Interest

Legitimate interest as a legal basis for processing people’s information will apply when:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

What this means is, as a private entity whose commercial interests rely on taking photographs, naming people in them and sending them out to press, it isn’t always necessary for the people in those images to give consent. 

This basis for processing is further compounded when:

“a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place”

In other words, if someone is attending an event where it is reasonable to assume that photographers would be present (as is often the case with these particular categories of photography) then the photographer or editor wouldn’t be a breach of the GDPR when processing this data without the person’s consent. 

This is all well and good for the industry as it is, but what about when using facial recognition software?

Processing ‘special category data’. 

As mentioned previously, when processing biometric information for the purposes of identification (like when using facial recognition software), not only does that need to fall under one of the above lawful bases for processing, but it also needs to fulfil one further basis in order to be deemed legal. 

There are ten additional lawful basis for processing this particularly sensitive personal data and depending on the individual purposes of the photographer, some of these may already be applicable, including:

  • Explicit consent.

  • Processing is necessary for carrying out particular obligations or exercising specific rights of the controller.

  • processing relates to personal data which are manifestly made public by the data subject.

  • processing is necessary for reasons of substantial public interest.

However, as this is a discussion specifically pertaining to the field of press, editorial, sports, entertainment, celebrity or otherwise newsworthy photography (hence why the acts of identification, captioning and image distribution are in fact being carried out) there is a further clause laid out within the GDPR called ‘the exemption for journalistic or artistic purposes’ which is particularly relevant here.

The Exemption for Journalistic or Artistic Purposes.

The GDPR allows for certain exemptions, overriding the rights and obligations set out within the document. Someone’s eligibility for these exemptions is determined by their reasons for processing the personal data. 

The exemption for journalistic purposes relieves a data processor of such obligations as:

  • The requirement of a lawful basis for processing;

  • The conditions for consent;

  • Children’s consent;

  • The conditions for processing special categories of personal data;

  • The right to be informed.

As well as many more, so long as:

  • The data processor believes that compliance with the above regulations would be incompatible with the purpose of processing;

  • The processing is being carried out with a view to the publication of some journalistic, academic, artistic or literary material; and

  • They reasonably believe that the publication of the material would be in the public interest, taking into account the special importance of the general public interest in freedom of expression, any specific public interest in the particular subject, and the potential to harm individuals.

So what this means for photographers and editors, is that the rules set out by the GDPR (such as gaining consent from a person to take their photograph and the limitations for processing their biometric information) do not necessarily apply so long as there is reasonable belief that it is being done so in the public interest for journalistic purposes.


The purpose of the GDPR was to set out a lawful framework to stop the misuse of people’s private data. The documentation itself can seem quite confusing and one would be forgiven for thinking that the authorities are out to catch them in the act, but people’s personal data is very important and so it is necessary for these regulations to be put in place. 

Despite the wordy legal jargon present, there is little reason for photographers and editors using Caption Pro to worry. Nearly all use cases of the software are covered by both primary and secondary lawful bases for processing. You may be processing the information of people already in the public eye, or covering an event where people should reasonably believe that photographers would be present. There are very few circumstances that would require additional questioning, but for peace of mind it is important to understand that press, editorial, celebrity, entertainment and sport photography are themselves dedicated fields of journalism.

Caption Pro sets out to facilitate the editing of certain IPTC and XMP metadata fields. These fields have been specifically created to accommodate the journalistic use of images. Not only that, but our users apply and share information that would already be entering the public domain, we aim to simply provide people with a tool to speed up and improve accuracy within this well established industry workflow.

If you have any queries about the steps we take to ensure a secure and private work space for our individual or collective teams of users, then please do not hesitate to get in touch with us at

Did this answer your question?