Who is accountable for privacy and image use at professional events?

Why This Matters for Security Teams

Professional events often feel low risk because the setting is public, but privacy obligations do not disappear just because photos are taken in a conference hall. The organiser remains accountable for notice, consent where required, retention, and downstream use of attendee images. That responsibility includes contractors, sponsors, and media partners that may reuse event content beyond the original context.

Security and privacy teams also need to treat images as personal data when a face, badge, nameplate, or location can identify someone. That means governance should cover collection, storage, access, and deletion, not just the camera policy on the day. Current guidance from the EU General Data Protection Regulation (GDPR) and the control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls both point to accountable handling, clear notice, and controlled retention.

NHI Management Group research shows how often identity data is mishandled in practice: 96% of organisations store secrets outside of secrets managers in vulnerable locations, and 79% have experienced secrets leaks, which is a reminder that weak process controls tend to spread across data types once governance is informal. In practice, many security teams only discover event-image misuse after a complaint, sponsor repost, or retention dispute has already occurred, rather than through intentional review.

How It Works in Practice

Accountability starts before the event opens. The organiser should define who approves photography, where images are stored, who can access them, and which uses are permitted. That includes branding, marketing, internal comms, press distribution, and any AI-enabled processing such as face grouping or automatic captioning. Where a vendor handles capture or publishing, the organiser still retains accountability and should contractually require equivalent privacy controls.

Operationally, the clearest model is to treat event imagery as governed data with a lifecycle. Notice should be visible at registration, on signage, and in event materials. Opt-out paths should be simple, such as badge markers or a registration flag, and the site team should know how to avoid photographing designated attendees where feasible. If images are retained, access should be limited, and deletion or redaction requests should have an owner and a deadline.

For teams that already manage identity and access risk, the same discipline applies here: define approval paths, restrict who can publish, and keep evidence of consent or legitimate basis where required. The Ultimate Guide to NHI is a useful analogue because it shows how poor lifecycle management creates lingering exposure. Even though attendees are not NHIs, the governance lesson is the same: if removal, retention, and revocation are not explicit, data stays usable long after the event ends. The IOS app secrets leakage report also illustrates how privacy failures often come from casual sharing and uncontrolled storage rather than a single major breach.

• Assign one accountable organiser for privacy decisions, even when photographers or sponsors are involved.
• Publish a short notice explaining when photography happens and how images may be used.
• Provide a visible opt-out and a contact route for objections or removal requests.
• Limit internal access to raw image libraries and delete content on a defined schedule.

These controls tend to break down at hybrid events with many third-party publishers because images are copied quickly across tools and jurisdictions.

Common Variations and Edge Cases

Tighter privacy control often increases event complexity, requiring organisers to balance attendee comfort against sponsor, media, and marketing needs. That tradeoff becomes sharper when the event is open to the public, streamed, or shared across multiple venues, because the same image may support legitimate coverage in one context and become intrusive in another.

Best practice is evolving for AI-generated event content, facial recognition, and automated tagging. There is no universal standard for this yet, but current guidance suggests treating these uses as higher-risk processing that should be explicitly disclosed and separately approved. If an event uses badge-scanning, attendee analytics, or livestream clipping, the privacy notice should say so in plain language rather than burying it in general terms.

One common edge case is press accreditation. Media teams may need broader publication rights, but that does not remove the organiser’s duty to set boundaries for attendee privacy and requests to remove identifiable images. Another is employee-only events, where internal policy often assumes implied consent. That assumption is weak when images are reused for external marketing or recruitment. In those cases, the organiser should confirm the lawful basis, set retention limits, and document the review path for objections.

Where events span multiple countries, local law can change notice and consent expectations, so the safest approach is to apply the stricter regional requirement to the whole event unless counsel directs otherwise.

Related resources from NHI Mgmt Group

• Who should be accountable for access governance when enterprises use a partner to implement identity controls?
• Who is accountable when AI regulation requires visibility into tool use and organisations cannot demonstrate it?
• How should government agencies evaluate GenAI use at public-sector events without creating new security and governance gaps?
• Who is accountable for correlating identity events across cloud and application logs during a security incident?