Questions Privacy Updated on
People in view: a 360 tour and the GDPR
The short answer
Only with their consent, or with another valid legal basis.
A recognisable face is personal data, so the moment someone appears recognisably in your tour you are processing personal data and the GDPR (in the Netherlands: AVG) applies. On top of that, the person has portrait rights and can object to publication. In practice the solution is simpler than it sounds: shoot when the building is empty. That is faster, cheaper and legally the cleanest. If someone does end up in view, we make them unrecognisable. And if a room has been furnished or emptied with AI, the image says so.
- A recognisable face is personal data under the GDPR.
- Consent must be freely given; with staff that is a point of attention.
- Number plates are also traceable to a person.
- Imagery furnished or edited with AI is disclosed as such (AI Act, Article 50).
Why a 360 capture is different from an ordinary photo
With ordinary photography you point the camera at something. Everything outside the frame stays outside the frame.
Read moreShow less: Why a 360 capture is different from an ordinary photo
With a 360 capture there is no outside the frame: the camera captures the entire sphere, including the colleague walking past behind the camera, the monitor with an open file on it and the noticeboard with the rotas pinned to it.
That makes it less a matter of being careful while photographing and more a matter of preparing the space before photographing. It is the same reason a shooting day in an empty building is not only more pleasant but also faster.
Staff are a special case
Consent under the GDPR must be freely given. Between employer and employee there is a relationship of authority, and regulators therefore look critically at consent from staff: saying "no" to the boss's photo does not always come easily.
Read moreShow less: Staff are a special case
That does not mean it cannot be done. It means you do it properly: ask in advance and not on the shooting day itself, make clear that saying no has no consequences, record where the imagery will be used and for how long, and make sure someone can withdraw their consent later. That last part is a right, so you also need to know what then happens to that viewpoint.
For most tours, by the way, this is a problem you can skip. An empty room shows the room better, and that is exactly what you wanted to show.
What else ends up in view by accident
half an hour
Read moreShow less: What else ends up in view by accident
Post and parcels with address labels, and personal belongings on desks that make someone directly identifiable.
The practical approach is a walk through the building before the shooting day, asking: what here would I not want on my website. That walk takes half an hour and saves hours of retouching afterwards.
- Screens. An open mailbox, a patient file, a customer list. In a panorama 20,000 pixels wide that is readable when you zoom in, and that is precisely the quality you paid for.
- Paper on desks, whiteboards and noticeboards. Names, rotas, phone numbers.
- Number plates in the car park. They are traceable to a person and belong among the things that have to come out.
Blurring: what it does and does not solve
Making someone unrecognisable works well for faces and number plates. It works less well for a person who is recognisable by one thing, such as a uniform with a name on it or a distinctive workstation.
Read moreShow less: Blurring: what it does and does not solve
If you publish to Google Maps, Google does its own blurring pass on faces and number plates. Do not rely on it blindly: that processing is designed for street imagery and is not flawless in indoor spaces. Whatever has to come out, you remove before it is uploaded.
Anonymising means someone can no longer reasonably be identified, not just that their face is a smudge.
Furnished or emptied with AI
If you furnish an empty room with AI, or empty a room with AI, it is no longer only about who is in view, but also about what is real.
Read moreShow less: Furnished or emptied with AI
Article 50 of the European AI Act requires that imagery of a real place that has been generated or edited with AI, and that could pass for real, is disclosed as such. That disclosure has to be clear, and be there at the latest the moment someone first sees the image.
With us it sits in the image itself, not underneath it. The future tour carries the label in every furnished view and shows the disclosure on the first visit, before you look around. The empty room in the 3D viewer also says in the image that AI emptied it.
How Omnitour handles this
- Shoot when it is empty
- Someone in view after all?
- Staff deliberately in view?
- No legal advice
Read moreShow less: How Omnitour handles this
- Shoot when it is empty. We prefer to shoot before opening hours or after. That is the arrangement we propose by default, because it largely removes the whole issue.
- Someone in view after all? Then we make them unrecognisable before the tour goes online.
- Staff deliberately in view? Perfectly possible, if it is about the people and not about the building. Then we arrange written consent in advance, and agree what happens if someone later leaves the company.
- No legal advice. What exactly is required in your situation depends on your organisation, and you know that better than we do.
Sources
A few follow-up questions
Do customers in view also need to give consent?
Yes, if they are recognisable. That is why we shoot public spaces outside opening hours; then the question does not arise.
Can someone be removed afterwards?
Yes. Someone can withdraw their consent, and then that has to be possible. We then make that person unrecognisable in that viewpoint.
Does this also apply to a tour that is not public?
The GDPR also applies to internal use, because it is about processing and not only about publishing. The balance is different, though: a tour behind a login for your own staff is something else than a tour on your homepage.
Continue reading
- May I show a room that has been furnished with AI? Showing a room furnished with AI is allowed, if you disclose it in the image and if it is structurally possible. What the AI Act and Funda ask.
- Does a virtual tour have to be accessible under WCAG? When a 360 tour has to comply with WCAG, which four requirements really matter, and what to ask your supplier as a school, care institution or municipality.
- How do I get my 360 tour onto Google Maps and Street View? Publishing to Street View goes through Street View Studio and no longer requires certification: Street View Trusted has ended. What has to be right technically and organisationally.