18th October 2018
Does your business use images of staff in its marketing materials? Or perhaps your face appears in a glossy brochure promoting the services of your employer? In this bulletin, we consider the rules around using photos of employees for marketing purposes under the GDPR and DPA 2018, and what steps an employer should take to prevent complaints of unlawful processing of data in this situation.
The image will be personal data if an individual can be identified from the image. This is the case even if you do not put the person’s name next to their photo as it would still be personal data if they can be recognised from the photo by using other sources of information, such as cross-checking the image with your website and identifying the person that way. Their physical appearance in the image might also reveal their religion, ethnicity or racial origin, meaning the image would amount to special category personal data under the GDPR.
Much will also depend on what the marketing campaign is for, who it is directed at, and who is likely to receive the brochure or leaflet. If a small business is marketing to its existing customers and it is likely that they will recognise an image of the staff, it will be personal data. If it is a nationwide marketing campaign and the photos are random shots of unnamed employees who are unlikely to be identifiable, then the employees may remain anonymous and the images will not be personal data. Each situation should be considered individually on its facts, but the safest route would to assume they are personal data to avoid a potential breach of data protection laws.
Assuming the images in question are personal data, then you need to ensure the images are being processed lawfully, fairly and transparently. One way of achieving this would be to get consent from each individual to use their image, but there are two potential problems with this, namely:
An alternative lawful basis for using the photos could be to rely on the legitimate interest of using the images to promote the employer’s products or services to generate business. Employees would need to have been given advance warning that their personal data may be processed for this purpose. However, with the additional protection under the GDPR for special categories of data, it is hard to see how photos could be used without employee’s explicit consent.
This is certainly a tricky area of new law which needs much consideration. An alternative option may be to pay for stock photos or for professional models to pose for photos under the terms of a written contract, so you can rely on the lawful basis of performance of a contract, and won’t be caught by the pitfalls set out above.
The contents of this update are intended as guidance for readers. It can be no substitute for specific advice. Consequently we cannot accept responsibility for this information, errors or matters affected by subsequent changes in the law, or the content of any website referred to in this update. © Mundays LLP 2018.
Céline Winham looks at confidential clauses and how all involved know their rights to prevent reputational damage on both sides
Jeremy Duffy and Annika Bell look ahead to the long anticipated probate fee hike
Andrew Knorpel points to some helpful guidance materials for employers to be suitably equipped for mental health in the workplace.