It generally creates a lot of confusion as to whether it is permissible to use images and videos of employees on the website, on the intranet and in marketing campaigns. We highlight here the rules.
The employer's website
As an employer, you can easily publish the employee's name, work areas and contact details. The basis for processing in these cases will be the data protection regulation's article 6, subsection 1, letter f (for private employers) and Article 6, subsection 1, letter e (for public employers). This also applies to prepared webinars, podcasts or other similar products with professional content that the employee has prepared as part of their employment.
Employee photos
If it is necessary due to the nature of the work, the employer has the option of stipulating that other necessary (work-related) information about the employee is published on the employer's website, including portrait photos.
This could be the case if it is a question of positions where the person in question is at the center of the work, or where the employee has functions particularly aimed at the public.
In other cases, the employer must ensure that the employee agrees to the publication of pictures or videos with the person in question. This can be done in relation to images, including portrait images, which can be easily replaced, by asking the employee for consent to the publication.
Recruitment and marketing videos
The same cannot be assumed to apply in relation to videos, including recruitment and marketing videos, which are costly to produce. In these cases, the employee's consent can hardly constitute a basis for processing, as the employee may have a fear of negative consequences if consent is not given or if it is withdrawn. In relation to this, the employer must therefore ensure in some other way that the employee agrees to the publication of videos of the person in question, and the consequences of participating, e.g. that material cannot be easily deleted or edited because this would be costly.
In practice, this can e.g. is done by making it clear at a staff meeting or on an intranet that you as an employer intend to prepare e.g. an advertising or recruitment video, and that the employees who wish to take part can contact the person(s) responsible for the production, and the employer at the same time points out that as an employee - in light of the costs involved - not without further may regret again.
If these conditions are met, the authority for the processing can be found in Article 6, paragraph 1, letter e (for public employers) and Article 6, subsection 1, letter f (for private employers).
Regardless of this, however, there may be cases where a (former) employee's objection may be justified and where the video must therefore be deleted or edited. See below.
Intranet
An employer can by virtue of the regulation's article 6, subsection 1, letter e (public employers) or Article 6, subsection 1, letter f (private employers) also put portrait pictures of the employees on an intranet so that the employees can put faces to the colleagues they have contact with.
In these cases too, an employee will be able to object to the processing. See below about this.
Private contact information
Publication of information about e.g. employees' private contact information such as private address and private telephone number or e-mail address and information about leisure interests or other information about the employees' private affairs will not, as a rule, be accommodated within the above provisions.
Objection
The right to object implies that the employee has the right at any time – for reasons relating to the individual's particular situation – to object to an otherwise lawful processing of his personal data.
However, the right only applies in cases where the employer processes personal data for the purpose of carrying out a task in the interest of society/exercising public authority or if the employer pursues a legitimate interest.
If, on the other hand, the employer has been required by law to carry out the specific processing of personal data, he will not be able to meet the objection for that reason alone. The same applies if the processing of the information is necessary for reasons of e.g. fulfillment of a contract.
When the employer receives an objection from an employee, the employer will already have once assessed that the processing is necessary for the performance of a task in the public interest/public authority task, or that the legitimate interests that make the processing necessary exceed the employee's interest in not having his personal data processed.
If, however, in his objection, the employee states a reason relating to the particular situation of the person in question, for the processing to cease, the employer must cease the processing, unless after a renewed assessment there are special reasons for continued processing.
If the employer comes to the conclusion in its new assessment that the treatment is still necessary, the employer must be able to explain this to the employee. The employer does this by explaining to the employee that a new concrete assessment of the considerations has been made and by justifying why the employer believes that the objection cannot be accepted.
Model contract
An alternative solution may be to enter into an agreement on the transfer of the intellectual property rights for the image and video material with the people the organization wants to participate in a possible campaign. Such an agreement falls outside the data protection legal rules and must instead comply with the general copyright rules of the game.