The Importance of Data Protection (GDPR) for Production Companies and Producers Navigating Data Protection Laws - why should you care?
Production Companies – as well as producers and filmmakers in general - deal with personal data in a variety of ways: they hold data for a variety of people – not only their employees and contractors, but also when contracting cast and crew on a new project.
Everyone who holds the personal data of a person based in the members states of the EEA (that’s the member states of the EU as well as Iceland, Liechtenstein and Norway) needs to comply with the EU’s data protection laws, i.e. the GDPR. There are similar data protection regimes in other countries, too. For example, the UK’s Data Protection Act is similar in scope to the GDPR and certain US states have comparable data protection regimes in place, too.
The data protection laws apply no matter where you, the producer or production company, are based. They apply to the person whose data you are holding. If you are based in the US but hold data of a person located in the EEA, then you need to comply with GDPR, too.
Therefore, if you are a producer or filmmaker, then it’s safe to presume that you are going to have to comply with data protection laws one way or another.
In this blog article, I am going to concentrate on the data protection laws of the EU (the GDPR) and the UK (Data Protection Act), that producers and filmmakers should be aware of. However, as I mentioned above, there are other, often similar, regimes in other countries, too – and they apply as soon as you hold data of a resident of that particular data protection regime.
What happens if I ignore data protection laws?
If you control and process “personal data” (see below) and you do not comply with data protection laws, there are authorities that could fine you. In the UK, the Information Commissioner’s Office (ICO) can issue fines of up to £17m (EUR20m) or 4% of global turnover. The fines need to be “effective, proportionate and dissuasive” and big fines have so far been mostly focused on companies using personal data – without clear permission - for cold-calling individuals, or companies handling sensitive personal data, such as passport data, in an irresponsible manner.
What is “personal data” in the film industry?
Personal data is “any information relating to an identified or identifiable natural person” – and an “identifiable natural person” is a person “who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (article 4(1) GDPR).
In other words, any information that might lead to a person being identified as who they are is protected. For example, if you are the producer and you enter into a contract with the scriptwriter, then you will be handling data such as the scriptwriter’s name and address. That type of personal data is protected by law and therefore needs to be handled carefully. If you handle more sensitive data, such as storing copies of passports for visa purposes, then you should seek legal advice on how to protect that data.
Data protection advice for producers, filmmakers, and production companies
On most productions, there will be more than one person responsible for entering into contracts with cast and crew. There will also be more than one person who can therefore see the ‘personal data’ (see above) included in the cast and crew contracts. As stated above, if you handle more sensitive data, such as passports, then access should be as restricted as possible, and you should seek advice on how to protect that type of data.
Everyone in your production company and/or on any of your projects should sign a contract containing stand confidentiality and data protection clauses. This could be contained in a standard NDA or confidentiality agreement – I wrote about those in a previous blog here.
If everyone who handles personal data has signed a confidentiality agreement, then you know that they will need to protect personal data the same way that you will. Depending on how you collaborate with your other crew members, they might already have a confidentiality and/or data protection provision in the contract that they’ve entered into with you during development or pre-production.
Therefore, if you contract a scriptwriter and then pass on their details to your co-producer, you know that your co-producer will also be under an obligation to handle the scriptwriter’s personal details with care. If the co-producer ends up breaching those clauses by sharing the scriptwriter’s personal details in a way that they shouldn’t have, then, in an absolute worst case scenario, the scriptwriter would sue you for breach of contract and you would, in turn, sue your co-producer for breach of the agreement that you have with them. I should say at this point that lawyers always think about worst case scenarios, of course.
Building trust and security
To get started, I would start with these simple steps:
Have a data protection policy in place for your company: where do you save data, who gets to handle that data and how will you protect it? Is there especially sensitive data – such as medical information or passport data from certain cast or crew members? How and where would you store that sensitive data and who has access to it?
Get everyone who works for and with you to sign a contract containing standard confidentiality and data protection clauses. If you have a standard agreement for your collaborators or any co-producers to sign, then those agreements might already have confidentiality and data protection clauses.
Next steps - working with an entertainment lawyer
If you have any questions about data protection in the film industry, please don’t hesitate to get in touch. I offer an initial call for free so that I can assess whether your matter is something that I can help you with and so that you can decide whether or not you want to work with me. You can get in touch with me here to schedule your free call with me.