Does your business use images of staff in its marketing materials? Or perhaps your face appears in a glossy brochure promoting the services of your employer? In this bulletin, we consider the rules around using photos of employees for marketing purposes under the GDPR and DPA 2018, and what steps an employer should take to prevent complaints of unlawful processing of data in this situation.
The image will be personal data if an individual can be identified from the image. This is the case even if you do not put the person’s name next to their photo as it would still be personal data if they can be recognised from the photo by using other sources of information, such as cross-checking the image with your website and identifying the person that way. Their physical appearance in the image might also reveal their religion, ethnicity or racial origin, meaning the image would amount to special category personal data under the GDPR.
Much will also depend on what the marketing campaign is for, who it is directed at, and who is likely to receive the brochure or leaflet. If a small business is marketing to its existing customers and it is likely that they will recognise an image of the staff, it will be personal data. If it is a nationwide marketing campaign and the photos are random shots of unnamed employees who are unlikely to be identifiable, then the employees may remain anonymous and the images will not be personal data. Each situation should be considered individually on its facts, but the safest route would to assume they are personal data to avoid a potential breach of data protection laws.
Assuming the images in question are personal data, then you need to ensure the images are being processed lawfully, fairly and transparently. One way of achieving this would be to get consent from each individual to use their image, but there are two potential problems with this, namely:
- the ICO’s advice to employers is that relying upon consent to process employee personal data should be of the last resort because of the perceived imbalance of bargaining power between employer and employee casting a doubt on whether the employee’s consent is “freely given;” and
- more importantly, consent can be withdrawn – so if an employee changes their mind about having their face appear in your annual review or promotional brochure, then technically you would need to stop using the documents containing the images, destroy all copies, and perhaps re-print them with the image removed.
An alternative lawful basis for using the photos could be to rely on the legitimate interest of using the images to promote the employer’s products or services to generate business. Employees would need to have been given advance warning that their personal data may be processed for this purpose. However, with the additional protection under the GDPR for special categories of data, it is hard to see how photos could be used without employee’s explicit consent.
This is certainly a tricky area of new law which needs much consideration. An alternative option may be to pay for stock photos or for professional models to pose for photos under the terms of a written contract, so you can rely on the lawful basis of performance of a contract, and won’t be caught by the pitfalls set out above.
The contents of this update are intended as guidance for readers. It can be no substitute for specific advice. Consequently we cannot accept responsibility for this information, errors or matters affected by subsequent changes in the law, or the content of any website referred to in this update. © Mundays LLP 2018.