The publication of employee photos is data processing within the meaning of Art. 4 No. 2 of the GDPR, which may be justified by an element of permission regulated by Art. 6 (1) of the GDPR.
According to Art. 6 (1) lit. f GDPR, this can be based on the protection of the legitimate interests of the controller or a third party. In the case of the publication of employee photos for the purpose of presenting the company or for advertising purposes, the balancing of interests to be carried out will regularly be in favor of the employee.
In this case, it is advisable for the data controller to obtain a declaration of consent in accordance with Art. 6 (1) a of the GDPR in order to be on the safe side. From the perspective of data protection law, the following points should be noted, among others:
- Sufficient information of the employee in text form, Art. 13 GDPR, Sec. 26 (2) p. 4 BDSG.
- Formal requirements of consent, Section 26 (2) sentence 3 BDSG, Section 22 KUG (interpretation requires written form in certain cases).
- Voluntariness of consent, Section 26 (2) BDSG.
- Free revocability of consent, Section 7 (3) GDPR.
- In principle, limitation of consent to the period of employment, Art. 5(1)(b) GDPR.
If you have questions in the area of GDPR compliant photo publication of employees or other data protection related topics, please contact us here!