Adopted: 21 September 2026  |  Review Date: September 2027

Photographs of the Public

A legitimate interest assessment written under the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and Data Protection Act 2018 for processing of personal data for the purposes of taking photographs of the public at council events.

Based on the ICO template.

Part 1: Purpose test

To assess whether there is a legitimate interest behind the processing.

  • Why do you want to process the data?
    • The council may wish to photograph groups of people who attend local events for publicity purposes or for historic record.
  • What benefit do you expect to get from the processing?
    • This activity boosts engagement with the council and has a wider civic benefit of promoting a more cohesive and inclusive local area.
  • Do any third parties benefit from the processing?
    • No
  • Are there any wider public benefits to the processing?
    • This activity has a wider civic benefit of promoting a more cohesive and inclusive local area.
  • How important are the benefits that you have identified?
  • What would the impact be if you couldn’t go ahead with the processing?
    • Events that the council held could not be publicised as effectively.
  • Are you complying with any specific data protection rules that apply to your processing (eg profiling requirements, or e-privacy legislation)?
    • N/A
  • Are you complying with other relevant laws?
    • N/A
  • Are you complying with industry guidelines or codes of practice?
    • N/A
    • Are there any other ethical issues with the processing?No, persons would not be photographed doing anything that is illegal, immoral or unusual.

Part 2: Necessity test

To assess whether the processing is necessary for the purpose identified.

  • Will this processing actually help you achieve your purpose?
    • Yes
  • Is the processing proportionate to that purpose?
    • Yes
  • Can you achieve the same purpose without the processing?
    • No
  • Can you achieve the same purpose by processing less data, or by processing the data in another more obvious or less intrusive way?
    • No

Part 3: Balancing test

To consider the impact on individuals’ interests and rights and freedoms and assess whether this overrides our legitimate interests.

Nature of the personal data

  • Is it special category data or criminal offence data?
    • Possibly capture special category data but it will be being made manifestly public at the time of the photograph.
  • Is it data which people are likely to consider particularly ‘private’?
    • No, the data would be available to everyone in the immediate area of the data subject in question.
  • Are you processing children’s data or data relating to other vulnerable people?
    • It is likely that children’s data and vulnerable peoples data will be captured.
  • Is the data about people in their personal or professional capacity?
    • Both, data captured from members of the public will be in their personal capacity and data captured from our staff and contractors will be in professional capacity.

Reasonable expectations

  • Do you have an existing relationship with the individual?
    • With our staff and contractors yes, with the public no.
  • What’s the nature of the relationship and how have you used data in the past?
    • N/A
  • Did you collect the data directly from the individual? What did you tell them at the time?
    • Yes, the data is collected directly from the individuals.
    • Signs will make clear that photography is being undertaken at the event and give details of the data controller, the purpose and lawful basis.
  • If you obtained the data from a third party, what did they tell the individuals about reuse by third parties for other purposes and does this cover you?
    • N/A
  • How long ago did you collect the data? Are there any changes in technology or context since then that would affect expectations?
    • Data will be collected at the time of the event in question
    • Technology is accepted
    • There is nothing novel or innovative
  • Is your intended purpose and method widely understood?
    • Yes, it is widely understood
  • Are you intending to do anything new or innovative?
    • No
  • Do you have any evidence about expectations – eg from market research, focus groups or other forms of consultation?
    • No
  • Are there any other factors in the particular circumstances that mean they would or would not expect the processing?
    • No

Likely impact

  • What are the possible impacts of the processing on people?
    • Minimal impact to people
  • Will individuals lose any control over the use of their personal data?
    • Yes data may be shared with social media and more traditional press
  • What is the likelihood and severity of any potential impact?
    • Minimal impact
  • Are some people likely to object to the processing or find it intrusive?
    • Yes some will object and find it intrusive
    • We will warn of the processing with just in time signage
  • Would you be happy to explain the processing to individuals?
    • Yes
  • Can you adopt any safeguards to minimise the impact?
    • Signs will make clear that photography is being undertaken at the event and give details of the data controller, the purpose and lawful basis.

Can you offer individuals an opt-out?            No

Outcome
Can you rely on legitimate interests for this processing? Yes
Do you have any comments to justify your answer? (optional) Photography at such events is understood .
LIA completed by:
Date: