1.1. Image Rights and Data Protection- The General Data Protection Regulation (EU) 2016/679 (GDPR)
It is also important to look at image rights from the data protection angle. The images of persons amount to data and therefore must be handled according to data protection principles. Data protection gives an individual the right to object to the unlawful processing of his or her personal data.
The General Data Protection Regulation (EU) 2016/679 (GDPR) has comprehensive provisions on data protection and it is imperative that it is considered first for a better appreciation of how data protection affects image rights. Furthermore, although the GDPR is an European Union (EU) regulation on data protection and privacy for all individual citizens of the European Union (EU) and the European Economic Area (EEA), it may also apply to persons outside the EU and EEA. For example, if you are a photographer from outside the EU, it could affect you if you hold the data of clients that reside in the EU.1 Although the GDPR has extensive provisions on various aspects of data protection, of concern is the aspect relating to image right.
Under the GDPR, 'personal data' means any information relating to an identified or identifiable natural person ('data subject') while an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.2 By virtue of this definition, any information that can be used to identify or recognise a person would be considered personal data and this would be qualified for the GDPR protection. This would include photographs, films, names, signatures, face expressions mannerisms, etc. Also, High-resolution recordings in HD often also enable biometric recognition of the persons depicted. 3 The facial image is personal datum and the additional data such as location and time of image capture or other GPS information are frequently stored as metadata for the individual digital photos.4 High-resolution recordings in HD quality often also enable biometric recognition of the persons depicted.5 The processing of personal data must therefore be done in accordance with the legal basis provided under the GDPR.6
1.1.1. Lawfulness of processing
For the data processing to be considered lawful, any of these conditions must apply:
- The data subject7 has given consent to the processing;8
- Processing is necessary for the performance of a contract with the data subject;9
- Processing is necessary for compliance with a legal obligation;10
- Processing is necessary to protect the vital interests of a data subject or of another natural person;11
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;12
- Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. 13
1.1.2. Data Subject Rights under GDPR
- Right to be forgotten14 - data subjects can request their personally identifiable data to be erased unless it is required to fulfil a legal obligation.
- Right of access15 - data subjects can receive a copy of the personal data stored about them.
- Right to object16 - data subjects can refuse to grant permission for an organisation to process their personal data.
- Right to rectification17 - data subjects can request that their inaccurate information be corrected.
- Right of portability18 - data subjects can request that their personal data be made available in a structured format and which they can transfer.
- Right to restrict processing19 - data subjects can request the organisation to stop processing their personal data.
It should be noted that where consent is the legal basis for the data processing, it must be freely given and also, this consent can be withdrawn at any time.
1.1.3. Further provisions
Under the GDPR, all parties that handle data are required to protect personal information from misuse and leakage.20 In addition, data controllers have to tell users when their personal data have been stolen in a data breach.21 Also, if they plan to transfer or share the data with another organisation, they must obtain the consent from the data subject.
1.1.4. Exemptions under GDPR
Due to the challenges these provisions may pose to freedom of expression and journalistic purposes, the GDPR provides that Member States must or may provide for exemptions from the GDPR for journalistic, scientific, artistic, and literary purposes to ensure freedom of expression and information.22 It must be ensured, however, that only the journalistic press (e.g., newspapers or photojournalists, possibly also blogs) falls under this exemption as a corporate press department will likely not be able to invoke this exemption.23 This means that these organisations may be able to use the images of individuals without having to comply with the provisions of the GDPR.
1.2. Image Rights and Data Protection - The Nigeria Data Protection Regulation 2019
There is presently no specific or comprehensive data privacy or protection law in Nigeria. There is however a subsidiary Regulation on data protection which is the Nigeria Data Protection Regulation 2019 (DPR), issued by the Nigeria Information Technology Development Agency (the "NITDA").
The DPR defines personal data as any information relating to an identified or identifiable natural person while an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.24 It can be anything from a name, address, a photo, an email address, bank details, posts on social networking websites, medical information, and other unique identifiers such as but not limited to MAC address, IP address, IMEI number, IMSI number, SIM, Personal Identifiable Information (PII) and others.25
This means that once an image can be used to identify a living individual, that image is likely to constitute personal data and the DPR would apply to it.
1.2.1. Governing principles of data processing under the DPR
Personal data can only be collected and processed in accordance with specific, legitimate and lawful purpose consented to by the data subject.26 However, further processing may be allowed for the purposes of archiving, scientific research, historical research or statistical purposes for public interest.27 Also, where this is the case, such person shall not transfer the personal data to any person.28
1.2.2. Lawful processing
The DPR provides for the conditions that would determine what lawful processing is.29 These provisions are identical to those provided for under GDPR but the condition that the processing is necessary for the purposes of legitimate interests is not provided for. Also, the consent of the data subject must have been obtained without fraud, coercion or undue influence.30
1.2.3.Rights of the data subject
A data subject can object to the processing of his personal data31 and he is entitled to information on any further processing beyond the purpose for which the data was collected.32 The data subject shall have the right to request that his data be deleted and33 the controller shall also take appropriate measures to provide any information requested by data subject in a concise, transparent, intelligible and easily accessible form.34 The data subject shall also have the right to obtain from the controller restriction of his data processing.35 The data subject also has a right to transmit the data.
1.2.4. Importance of the Data Protection Regulations on Image Rights
The data protection regulations can be used by both private individuals and celebrities to prevent the processing of their Personal data, such as publications of their photographs without their authorisation. It is important to note that a person subject to the DPR who is found to be in breach of the provisions, shall be liable in addition to any other criminal liability, to the strict penalties provided under the DPR. 36 However, there is no known case in Nigeria where an image rights action has been brought under this heading.
2. ENFORCEMENT OF IMAGE RIGHTS
In Nigeria, these rights are usually not enforced. There are many instances of the usage of celebrities' pictures by business enterprises without their consent or knowledge, with no legal action taken against them. It is doubtful if the legal protection discussed above can offer sufficient remedies for image rights infringement. As there are insufficient Nigerian cases on this, it is useful to consider if these legal protections above have afforded sufficient remedies in other jurisdictions.
In the case of Reklos and Davourlis v Greece,37 a baby who had been put in the sterile unit was photographed by the hospital for commercial activities without the permission of his parents, the Greek courts held that where a person's photograph was taken without permission, a breach of privacy had occurred. Also, in the older case of Von Hannover v Germany,38 the Princess Caroline Von Hannover of Monaco whose pictures had been taken in public without her authorisation, applied to the German court to prevent further publication of her picture as it constituted breach of her privacy, the German court dismissed the Claim but the European court held that the Defendants had breached her right to privacy in the circumstances.
In Nigeria, in the Nigerian Copy right case of Peter Obe v Grapevine Communications Ltd,39 the court held that the Defendant's act of publishing the Plaintiff's photograph without license or authorisation amounts to infringement of the Plaintiff's copyright in the photograph and in the book entitled "Nigeria Decade of Crises in pictures."
In most situations, people seek remedies under other legal actions such as tort of passing off, defamation, etc.
2.1. The Tort of Passing Off
Generally, the tort of passing off is restricted to goods and services. However, considering the two popular United Kingdom (UK) cases of Irvine and others v Talksport40 and Robyn Rihana Fenty & Ors. v. Arcadia Group Brands Limited (T/A TOPSHOP) & Anor,41 where the Plaintiffs had successfully brought actions against the Defendants under the tort of passing off for the unauthorised use of their images; Nigerian courts may be persuaded to extend the tort of passing off to protection of image rights, if the person can establish the three elements of passing off. The individual must establish that his image has acquired sufficient goodwill such as quantifiable goodwill which can be leveraged on in consideration for money. He must then prove that the third party has misrepresented to the public by using the image and this misrepresentation caused or is capable of causing lot of damages to him such as reduction in the value attached to the goodwill.
2.2. The Tort of Defamation
The person whose image rights were infringed may also bring an action for tort of Defamation against the third party. For example, a celebrity who is strongly against the use of cannabis but his picture was used to advertise a cannabis product may feel that this action would negatively affect his public image and career. He may then bring an action for tort of defamation against the cannabis company. An example of this scenario is the case of Tolley v J S Fry and Sons Limited42 where a company head featured an amateur golfer in an advertisement. The golfer brought an action against the company on the ground that the advertisement portrayed him as a professional golfer which may cause him to lose his membership with his amateur golf club and the advertisement was therefore defamatory. The House of Lords held that there was evidence which showed that the advertisement would be harmful to the golfer in view of his membership at his amateur golf club. The action for damages therefore succeeded.
In view of the developments in the UK, United States (US), India and other jurisdictions, Nigerian courts are encouraged to adopt the progressive approach being adopted by the other jurisdictions in the protection of Image rights of individuals.
3. CONCLUSION
Image right is a very significant intellectual property right which many people are quite unaware of. However, owners of these rights are beginning to see its importance due to the different complications arising from it. Nevertheless, due to the paucity of regulations governing it in Nigeria and in many other countries, its development has been severely stunted. This has resulted in many instances of image rights infringements and undue exploitation. It is anticipated that a law making explicit provisions on image rights will be enacted to address these deficiencies. In the meantime, it is hoped that Nigerian courts will recognise these rights and consider the actions that are brought under the other related laws.
Footnotes
1. No author, 'GDPR for Photographers. Will it affect you?' (Skylum, May 23) (https://skylum.com/blog/what-is-gdpr-and-how-will-it-affect-you) accessed 7 August 2019.
2. Art. 4 (1). GDPR.
3. Ibid. (note no ).
4. Y Schäfer, 'Does The GDPR Also Apply To Photographs And Films?' (Mondaq, 2 July 2018) (http://www.mondaq.com/germany/x/714306/data+protection/Does+The+GDPR+Also+Apply+To+Photographs+And+Films) accessed 7 August 2019.
5. Ibid.
6. Ibid. Art. 6 GDPR
7. Data Subject means an identifiable natural person; one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Ibid. Art. 4 (1).
8. Ibid. Art. 6 (1) (a).
9. Ibid. Art. 6. (1) (b).
10. Ibid. Art.6. (1) (c).
11. Ibid. Art. 6. (1) (d)
12. Ibid. Art. 6. (1) (e).
13. Ibid. Art. 6. (1) (f).
14. Ibid. Art. 17.
15. Ibid. Art. 15.
16. Ibid. Art. 21.
17. Ibid. Art. 16.
18. Ibid. Art. 20.
19. Ibid. Art. 18.
20. Ibid. Art. 32.
21. Ibid. Art. 33 and Art. 34.
22. Ibid. Art. 85(1) and (2).
23. Supra note 29.
24. Nigeria Data Protection Regulation 2019 (DPR), Art. 1.3. (xix).
25. Ibid. Art. 1.3. (xix).
26. Ibid. Art. 2.1. (1) (a).
27. Ibid. Art. 2.1. (1) (a) (i).
28. Ibid. Art. S 2.1. (1) (a) (i).
29. Ibid. Art. 2.2.
30. Ibid. Art. 2.3 (2).
31. Ibid. Art. 2.8 (a).
32. Ibid. Art. 3.1 (7) (m).
33. Ibid. Art. 3.1. (9) (d).
34. Ibid. Art. 2.13.1.
35. Ibid. Art 2.13.10.
36. Ibid. Art. 2.10.
37. Reklos and Davourlis v Greece (application no. 1234/05).
38. Von Hannover v Germany no. 2 (application no 59320/00), 2004-VI ECHR 294
39.
40. Irvine and others v Talksport [2003] 2 All ER 881
41. Supra note .
42. Tolley v J S Fry and Sons Limited 1 All ER Rep 131.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
