May 25th 2018 might be well behind us now, but GDPR is still one of the hot topics of the day. Now that the notorious regulation is finally in effect, businesses across the UK are starting to get to grips with life under GDPR, and all the changes it’s brought. For many industries, the new rules haven’t changed much in day to day operations. But in the video production world, there are a whole host of new processes we’ve got to follow to make sure we’re producing GDPR compliant videos for our clients. But what exactly does that mean, and how will it change the way our clients approach video marketing?
A Little Background On GPDR
Just in case you missed it in the run-up, we wanted to give you a (brief!) reminder of what GDPR actually is. It’s short for the General Data Protection Regulation and is an EU regulation that defines how businesses collect and use personal data. The aim is to strengthen the rights of the individual and data subjects within the EU, and it’s structured around seven main principles:
1. Transparency on how data will be used and what it will be used for.
2. Ensuring that the data collected is used only for the purposes explicitly specified at the time of collection.
3. Limiting the data collection to what is necessary to serve the purpose for which it’s collected.
4. Ensuring the data is accurate.
5. Storing the data for only as long as necessary within its intended purpose.
6. Prevention against unauthorised or accidental loss of data through the employment of appropriate security measures.
7. Mandatory demonstration of compliance with the above principles by businesses and organisation handling the data, mainly through providing tracked and maintained records and documentation.
So that’s GDPR in a nutshell, but what’s it got to do with video marketing? Well for one thing, someone’s face and voice fall under the definition of ‘personal data’ for GDPR, (since they can be used to identify the individual) – so GDPR applies across the board.
If there’s one thing GDPR is big on, it’s consent. And it’s no different in video than it is in any other form of marketing. For video, it means you need to make sure you have complete consent from everyone who will appear on camera in your video, or who will do a voice over. This needs to be a written document that you can keep for your records in the future and is usually covered by a release form. One exception to this is when you’re filming at events, where you will shoot crowds and groups of people. Here, you don’t need individual consent forms – but you do need a statement at the event sign in table or on the entrance doors which explains that the event is being filmed, and if they do not wish to be part of the film, they need to notify the event organiser.
Sounds simple, right? But it doesn’t end there. You see, GDPR also gives individuals the right to the deletion of their data if requested. But removing people from your videos isn’t as easy as deleting a word document or line from your accounts. In order to fulfil requests for data deletion in video, you need to be able to de-identify them. That means removing their face, their voice and anything else that could identify them. For some you could get away with just blurring out their faces, but for more complex videos this can provide a real challenge.
Legitimate Interest To The Rescue!
But hang on, that’s not really practical or fair to businesses? After all, some organisations pay thousands of pounds to have video content created to use for their marketing and branding for years to come. But if video content is created on the basis of individuals consenting for the business to use their imagery, but that consent can be withdrawn at any time, is there a risk that businesses will have to stop using that footage if consent is withdrawn later on?
You see, consent isn’t the only grounds for processing data under GDPR – there are many more. One of these is ‘legitimate interest’, which means a business would be able to continue to use that footage event if consent was withdrawn – if they could be proven to have legitimate interest in using it. A legitimate interest is defined by GDPR as:
• The being a real business interest being pursued in continuing to process the personal data.
• The processing is absolutely necessary in order for the business to pursue that interest (i.e. the interest cannot be pursued in another way which is proportionate).
• The processing is balanced against the impact such processing will have on the fundamental rights and freedoms of data subjects.
So really, legitimate interest is dependent on the individuals circumstance of the business. Either way, your business needs to be able to show documented evidence that the GDPR processes have been followed, and be able to demonstrate a legitimate interest if needed.
At Ginger Video, we work with businesses across the UK to produce stunning videos that really get them noticed, while still staying on the right side of GDPR. Whether that’s a 30-second promo for a big brand like The Hairy Bikers, or coverage of a day long conference, our team work with you to understand the goals and drivers behind your business, before creating effective, compelling videos to promote your business.
If you’d like to know more about keeping your videos compliant with GDPR, please don’t hesitate to contact us today on 01488 670244, or complete the contact form below.