Member data then and now
What an old picture directory did with member data, what UK data rules demand now and how long a buyer's details should be retained securely today.
· The editorial team of The Rights Desk · Finding and Provenance
You still find old member directories, printed yearbooks and spreadsheet lists in picture desks across the UK. If you buy images, those habits matter because current law expects you to keep personal details only while you need them and to explain how you use them.
Why old contact lists cause trouble now
Many buyers keep the names, phone numbers and email addresses of photographers, fixers, models and previous suppliers long after a job has closed. That kind of directory was once kept in a drawer and nobody questioned it. Data protection legislation now controls how personal information is used by organisations, including businesses and government departments, which includes a small publisher or studio that buys pictures. In the UK the rules come from the UK General Data Protection Regulation and the Data Protection Act 2018. The reason is simple. A list that is never checked becomes inaccurate, is kept for vague reasons and can be seen by people who have no need to see it. You are expected to treat that list as carefully as you treat the images themselves.
What counts as personal data when you buy pictures?
When you commission or license a photograph you often collect more than pixels. You collect the name of the photographer, the invoice address, the model release paperwork with a name and signature, and sometimes notes about where a person lives or works. All of that can identify a living person, so it falls under the same duties as any other personal data. Everyone who decides how such data are used must follow strict rules called data protection principles unless an exemption applies. There is a guide to the exemptions on the Information Commissioner's Office website, which administers the system. For a buyer, the lesson is practical. Ask yourself why you hold each name and whether you still need it for licensing, crediting or proving permission.
How long can you keep names and releases?
Old directories were kept forever because paper was cheap and nobody weeded the file. Current duties point the other way. You must use information for specified and explicit purposes, keep it adequate, relevant and limited to only what is necessary, and keep it for no longer than is necessary. A model release that proves you had permission to publish a portrait may need to be kept for the life of the licence. A list of freelance contacts you have not used for years does not meet the same test. The GOV.UK page does not publish fixed retention periods. You set a period that fits the purpose, write it down, and then delete or archive the data when the period ends. Accurate records that are kept up to date where needed also help you answer if someone asks what you hold.
What does transparent handling look like for a buyer?
Transparency means the person can understand what you will do with their details before you do it. Anyone responsible for using personal data must make sure the information is used fairly, lawfully and transparently, and handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage. In picture buying that means clear credit terms, clear storage and limited sharing. Tell contributors where their contact details are stored, who can open the folder and how you send files to a designer or printer. You can read the details in the UK data protection rules and check how the principles apply to your workflow. Locked drives, named folders with access limits and a habit of removing old attachments from email threads do more for compliance than any long policy document.
Why do some details need stronger care?
Most buyer files contain ordinary contact facts. Sometimes they contain far more sensitive information, and the law gives that information stronger legal protection. The categories named in the legislation include race, ethnic background, political opinions, religious beliefs, trade union membership, genetics, biometrics where used for identification, health, and sex life or orientation. There are also separate safeguards for personal data relating to criminal convictions and offences. You might meet such details in a caption, a documentary project description, a casting note or model release paperwork that records health or background. The reason for extra care is risk. Misuse can lead to discrimination or harm, so you need a clear purpose, tighter access and a shorter retention period than for a simple invoice address.
What can people ask you to do with their data?
People whose data you hold have rights, with some exceptions. Under the legislation those rights include being informed about how data are used, getting access to personal data, having incorrect data updated, having data erased, stopping or restricting processing, data portability that lets a person get and reuse data for different services, and objecting to how data are processed in certain circumstances. There are also rights when an organisation uses personal data for automated decision making without human involvement and for profiling, for example to predict behaviour or interests. For a buyer this often means a photographer asking for a copy of what you hold, a model asking for a correction to a name spelling in your provenance records, or a contributor asking you to delete marketing contacts. You should know where the data are stored so you can find, correct or remove them without searching through years of inboxes.
Where does a complaint go if handling goes wrong?
If someone is concerned about how an organisation is handling personal data, the route is to contact the Information Commissioner's Office for advice or to make a complaint. The telephone number is 0303 123 1113 and the textphone number is 18001 0303 123 1113, open Monday to Friday, from 9am to 5pm, with information about call charges available. The office address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, and further contact details are on its website. For you as a buyer, that external route explains why internal order helps. Keep a short log of what personal data you collect for each shoot or licence, note the purpose and the deletion date, and give one person responsibility for answering access or deletion requests. Open your current supplier sheet today and remove names you can no longer justify keeping.
