So I've seen some scare stories about how the GDPR will require model releases for every identifiable person in a photograph if it's to be used for anything other than a 'personal record'. i.e. if it shows up in a book, social media, web site, print for sale, etc. and has an identifiable person (i.e. their face, or enough of their body to uniquely identify them) then you'll need a model release, and you'll need to deal with GDPR in all regards (i.e. if they subsequently ask to be forgotten, you'll need to handle that). I can't personally see how that could be a true interpretation, but I can see how it might be a valid fear. Does anyone have access to more facts about that - or professional advice?