Zum Inhalt Zum Hauptmenü


How privacy limits the use of photos

Die Presse
22. Juli 2018

Use of images in companies. If the use of photographs is not justified by the legitimate interests of the company, it generally requires the consent of the persons depicted. This must be declared voluntarily in order to have the desired effect.

In view of the General Data Protection Regulation (GDPR), which has been in force since 25 May, companies are often faced with the question of how the new regime will affect the diverse operational use of images. Finally, it is common to publish employee portraits on the company's website, post at-work photos on social media, use photos of event participants or use people as advertising testimonials to polish your image.

Although it was already recognised before the GDPR that a person's image constitutes a personal date, data protection law has so far hardly played a practical role in connection with images. Because there was a lack of awareness of the connection to data protection law, civil image protection dominated. This is now likely to change with the GDPR. Finally, the use of (especially digital) photos must now be examined on the basis of data protection standards because of the primacy of European law. However, the regime of image use has not changed completely with the GDPR.

Pointing out recordings

Similar to civil image protection, photos may be created and used if there is a legitimate interest on the part of the data protection controller (i.e. the company). This can usually be argued in event photography, as long as a larger group of people is covered in common (not exposing) situations. Finally, the company concerned has a valid interest in informing the general public about an event that has taken place, including pictures. However, a clear reference to the photographs is recommended in order to meet the expectations of the event participants. Furthermore, the same reason for justification also applies to photographs of public areas with unintentionally photographed persons. Within the company, legitimate interests also come into consideration when using employee photos for a contact database (to facilitate cooperation) and for ID cards (for security reasons).

If image use in the company is not justified by legitimate interests, it can usually only occur based on consent. In practice, this is particularly the case when employee photos are used on the company's website or on social media channels. Likewise, the use of photographs for advertising purposes requires a corresponding declaration of consent from the person depicted as an advertising testimonial. The same applies to promotional videos in which employees are prominently involved.

In particular, companies must bear in mind that consent to the use of images must be given voluntarily. In any case, it would therefore be inadmissible to make employment with the company dependent on the consent of the new employee to publish his or her picture or to link it to the employment contract. Furthermore, companies must observe the increased requirements for determining the content of the declaration of consent with regard to the specific purpose and the intended scope of image use.

Withdrawal possible at any time

As a special challenge, the persons depicted can ultimately withdraw the consent once given at any time with effect for the future. Then these photographs may no longer be used - however, photo use that has already occurred remains legal. Therefore, photos must be deleted from online media if the consent is no longer valid. Printed works that have already been created do not have to be destroyed, but may no longer be actively used and distributed.

Irrespective of the legal basis for taking and using photographs, the new data protection regime provides for extensive information obligations. In particular, all persons depicted must be informed about the purposes for which the images are used, the legal basis on which this is done, how long the images remain saved and what rights they have. This obligation is usually fulfilled by data protection notices - for example posters at events or via the employee data protection declaration.

Even if, contrary to some fears, the applicability of the GDPR to image recordings does not lead to a complete abandonment of existing principles, companies must in particular (i) clarify and document the correct legal basis for image use, (ii) comply with stricter requirements for obtaining declarations of consent and (iii) comply with comprehensive information obligations. The use of images for legitimate interests remains permissible - similar to the use of images under civil law.

© 2020 · DORDA · Facebookinstagramlinkedin  PODCAST