As a data controller if you are taking photograph images either at your events and shows you need to have:
1. Posters stating images are being taken and have a point of contact to obtain a copy of any image taken where the person is the main focus
2. Have in your privacy notice how, when, why you will take images, how long you will retain, use, share and secure the information.
3. How an individual can exercise their rights to access, object and request images to be erased. If posted on 'Information societies' e.g. social networks/search engines/websites how they can exercise their right 'To Be Forgotten'.
Therefore, the organisation running the event need to ensure, via posters, to make the attendees aware of whom the photographer is and individuals should have the option of not being photographed. Permission should certainly be sought before photographs are used for publicity/marketing.
Wording a poster in a concise way is difficult enough, but how would it work in reality?