Could Your Use of Employee Photos Be in Breach of GDPR?

Andrew Gallie

Employers often want to use photographs and video recordings of their employees for publicity or promotion related purposes. Here, we look at some of the legal issues which may arise and how to avoid common pitfalls.

Using photos and video recordings (images) of employees can be a good way to promote your business, for example, by including material in a recruitment brochure or on your website.

However, before taking and using images for these purposes, employers should ensure they are compliant, so as to avoid the pitfalls which can prevent material from being used as intended.

Data Protection

Taking photographs of employees will involve processing their personal data, which means that the employer must have regard to its obligations under the GDPR.

One of the first points to consider is whether it would be appropriate to ask the employee for consent. The answer will very much depend on the circumstances. In some cases, consent will not be necessary but often, consent is seen as a 'safer' option. However, even where consent is not sought, it is still important to be transparent so that an employee has an opportunity to object.

As anyone familiar with data protection will know, relying on consent under GDPR is fraught with difficulty, particularly in relation to employees. Any consent will have to meet the GDPR standards of being "freely given, specific and informed". A form that states "by signing below you consent to us taking photos of you" is not compliant. In a similar vein, the consent will not be valid if the employee feels pressured into giving consent. It must be a genuine choice and the employee must not suffer any detriment if they decline to take part.

Intellectual Property (IP)

In some cases, an employee's participation will create IP rights. IP rights arise in numerous situations, including in relation to work associated with the photograph as well as participation in any media campaign. In addition, employers should also be conscious of an employee's 'moral' rights which may also arise during these situations, such as the right to be identified as the author.

As such, employees should be asked to assign any such rights to the employer and also agree to waive any moral rights. This can be covered in the GDPR consent form, but will need to be worded carefully to ensure it is legally binding on the employee and include any IP rights which may not be covered under any associated 'standard' IP clause in an employee's contract of employment.

Anything Else to Think About?

Where the employer uses a third party to take the photograph(s) or make the recording (such as professional photographer), then the employer should check that its contract with the photographer gives the employer full ownership of the IP rights in the work. This is an important point as the photographer will retain ownership unless the contract says otherwise, even if you have commissioned the work and/or agreed the transfer of ownership orally.

In addition, you should consider including extra protection in the contract with the photographer to protect yourself against IP infringement liability that may be passed to you via use or ownership of the work created.

A licence to use the images won't necessarily be enough. For example, if the contract gives the employer a licence to use the photographs in a printed recruitment brochure and the employer subsequently uses the photographs on its website, it is likely that the employer will be in breach of copyright and will be at risk of a claim from the photographer.

The above sets out the position where an employer intends to use images of an employee for promotion and marketing related purposes. Different considerations apply to other types of use, for example, taking a photograph for a name badge or capturing images via CCTV.