According to the GDPR, consent is one of the six lawful bases for processing personal data, but not

the only one. The other five are: contract, legal obligation, vital interests, public task and legitimate

interests. Legitimate interests can be invoked by controllers who process personal data for their own

benefit or for the benefit of third parties, as long as such processing does not override the rights and

freedoms of the data subjects, especially if they are children. The GDPR also recognizes that

processing personal data for journalistic purposes or the purposes of academic, artistic or literary

expression may be necessary for the exercise of the right to freedom of expression and information,

which is a legitimate interest. Therefore, the company may not need to obtain the consent of

everyone whose image they use for their documentary, if they can demonstrate that their processing

is necessary for the purposes of their journalistic, artistic or literary expression, and that they have

taken into account the reasonable expectations of the data subjects and the potential impact on their

privacy. The company should also comply with any relevant national laws or codes of conduct that

may apply to such processing. Reference:

GDPR, Article 6(1)(a)-(f)

GDPR, Recital 47

GDPR, Article 85