What rights apply to employee photos?

If the individual employee can be identified directly from a photo on, for example, an employer’s website, then the image will be personal data and processing of the image by the employer will be governed by the GDPR.

The GDPR requires employers to have a lawful basis on which to process their employees’ data:

(1) consent of the employee;

(2) for the performance of a contract;

(3) so that the employer can comply with legal obligations;

(4) there are vital interests of a life or death nature;

(5) the processing is in the public interest; or

(6) there is a weighed and balanced legitimate interest in the data being processed.

Consent

An employee may be happy to provide consent to their employer using their image, but employers need to bear in mind that, under GDPR, consent must be freely given (i.e. not coerced) and the employee can withdraw consent at any time.

Because consent can be withdrawn so easily, it is wise for employers to consider alternative grounds on which they can take and use the image at the outset.

This may include the performance of an employment contract or to meet the legitimate business interests of the employer.

It is important to note that an employer cannot retrospectively change the legal basis for processing data.

Employers should inform employees at the time their image is taken what the image will be used for and on what basis it will be processed.

If an employer relies solely on an employee’s consent and that consent is withdrawn, then the image should be removed as soon as reasonably possible.

What is the legitimate interest case for using an employee’s image?

The legitimate interest case will depend on a number of factors, including how the employer uses the image of the employee/ex-employee.

For instance, ex-employees may appear on hard copy or digital marketing materials and may appear on their own or as part of a group.

Assuming that this basis was in place at the start, what is important from the GDPR viewpoint is that the employer has weighed and balanced its own legitimate interests against the ex-employee’s interests when deciding whether to comply with the request.

The balancing exercise

Employers should undertake a balancing exercise and record how their decision was made.

For example, the factors could be:

• how important is keeping the image to the employer?
• how important is deleting the image to the former employee?
• was the employee told at the time the photo was taken that their image might be retained after their employment ended?
• how easy is it for the employer to delete the image and is there a cost involved?

How easy it is to delete an image will depend on the circumstances.

For instance, it is likely much easier to remove individual headshot photos from a company website than to replace an image on a printed brochure.

Taking the example of a company website with a headshot of a former employee, it would be likely that the employee’s interests would outweigh those of the employer when taking the above factors into account.

The same is likely to be true of any team or group photo used on a company website as this would be relatively easy to replace with an up-to-date image for most employers.

Compare this with similar images on paper brochures or advertisements.

If those items have already been handed out to clients or prospective clients, it is unlikely to be reasonable to recall/ replace these.

If there is a stack of such brochures waiting to be used in the office, an employer will have to consider how easy and costly it is to replace them.

Replacing paper brochures, for example, is more likely to be necessary if the former employee was not told their image would be retained and has recently left their job at a company with an established reputation to a new business in the same or a similar sector.

In such a case, the former employee is likely to have a good reason to want their image and name association with a former employer removed.