I’d appreciate some advice regarding company group photos and whether they are personal data. There isn’t anything in the photos to identify an individual, just that they work/have worked for the company. We didn’t collect consent for them at the time and some of the individuals have now left, so I would appreciate any views on whether we can still use these photos. Thanks
PhilBrining
This question always interests me and the answer sadly is not as simple as it should be. Context is key. The ICO has always taken this view. Read their guidance here (page 15) which although is out of date does reflect their thinking. https://ico.org.uk/media/for-organisations/documents/1554/determining-what-is-personal-data.pdf
It is often safer to assume that all images are likely to contain or be personal data because as the guidance referenced above states, if the use of the images changes, they may fall within the scope of data protection law.
You don’t need consent to keep photos (i.e. process personal data) — you might well be able to rely on a legitimate interest. But you should have provided privacy information (Art 13) to the people in the photos. In the employment context this may have been accomplished by providing a Staff Handbook or an employee privacy notice?
Egil Bergenlind
Hi there,
A photo of a person, whether in group or not, should typically be considered personal data.
We often see companies relying on legitimate interest for this type of processing, in summary arguing that the data is not sensitive and that the company benefits from having this data to conduct/improve its business (if you intend to rely on LI, you should of course do a proper assessment based on your needs and data subject risks). If you are able to blur out faces should people have objections, that simplifies life of course.
Consent is rarely a good idea in the employment context since the employee is in a position of dependence.
Would be great to hear more experiences and views!