Facial recognition at events and GDPR: a guide for organizers

Biometric data

A selfie used to generate a face template for matching is biometric data under the GDPR when it is processed to uniquely identify a person. That is a higher bar than 'we took photos of a crowd'.

Relivo's product model is: the guest opts in, the template is used to find photos of that guest, and the guest can revoke. That is not the same as identifying everyone who walked through a door.

Consent and lawful basis

Consent must be freely given, specific, informed and unambiguous. For biometric data, the GDPR requires explicit consent unless another Article 9 condition applies — do not invent one.

Freely given is hard if 'you cannot get any photos unless you biometric-opt-in' is the only path and the guest had no real alternative. Offer a way to refuse matching.

Legitimate interest is often used for ordinary event photography of a public event. It is a weak, high-risk story for biometric templates. Prefer explicit consent for selfie matching.

Attendee disclosure

Tell people, before the selfie: who the controller is, that Relivo (Digitalstories BV) is the processor, what is collected, why, how long, who can see the gallery, and how to withdraw.

Signage that only says 'photos are being taken' covers photography. It does not cover biometric matching. Put the matching explanation on the selfie screen and in pre-event comms.

Retention

Keep photos for as long as the event gallery is actually used. Keep biometric templates only as long as matching needs to run. Relivo's public materials describe default retention measured in days/months for event delivery, not indefinite biometric vaults. Confirm the current default on /privacy and your DPA.

Controller and processor

The organizer (or agency acting for the client) is typically the controller of the event. Relivo is the processor for platform processing. Sign the DPA. Do not pretend Relivo is the controller of your attendee relationship.

Deletion

Guests need a way to request deletion of their selfie, template and personal gallery. Organizers need a way to take an event down. 'Email us sometime' is not a process — publish the path.

Data residency

Relivo hosts guest data in the EU. If you use a US consumer album with face grouping, you need a transfer story (SCCs, etc.) and still need a biometric lawful basis. Residency does not legalize purpose-creep.

DPIA considerations

A DPIA is typically expected for systematic biometric processing. Document: the matching purpose, alternatives you rejected (manual tagging, public album), consent UX, retention, subprocessors, breach plan, and residual risk to attendees who did not opt in (they should not be identified).

Have counsel review the DPIA. Relivo can describe the product; it cannot sign your risk acceptance.

Photography vs biometric processing

Taking photographs at an event and publishing a selection can be a different processing activity from generating face templates. Do not hide matching inside a generic 'we take photos' notice. Split the purposes in your record of processing.