iA client put this to us the other day – assuming that a photo or video footage of a current or former employee counts as his personal data, which it does, how far will his GDPR “right to be forgotten” allow him to reach into the employer’s records and require that image to be deleted?
The client had three particular circumstances in mind – where the images are used in its external marketing or training material, in the “Our Team” or “Events” section of its website or on its intranet. In each case, could the employee or ex-employee require the amendment or deletion of any photo or video with him in it, or the pulping of the employer’s possibly very significant investment in hard-copy brochures?
The starting point for the answer is that a lawful basis for processing those photos and videos would need to be established. The GDPR sets out several potentially lawful bases for this, one of which is where the processing is necessary for the employer to pursue a legitimate business interest. In those circumstances a balancing test weighing the interests of the employer against the interests and fundamental rights and freedoms of the employee must be carried out and documented. Unless the employee’s interests override those of the employer, the processing can proceed.
How you decide the balance of interests is a question of proportionality, weighing the impact on the rights of the individual and those of the employer. The employer will of course need to make clear when the photo or video is taken what the image will be used for, how and where it will be displayed, and for how long. This “notice” is required by the transparency provisions of the GDPR. For example, the traditional uncomfortable mug-shot used for the “Our Team” section on the website has a clear value while he is still on the books but is of no continued use once the employee leaves and so should obviously be removed at that stage. However, the employee’s departure does not prejudice the marketing or employment relations value to the employer of a crowd shot from a particular corporate event, so the position would be different. Essentially, the less the significance of the individual employee’s image to the whole, the stronger the employer’s legitimate interest in continuing to use it.
Therefore it makes sense to tell the employee that the training or marketing video you are asking him to take part in may be used even after he leaves the business. That will be important ammunition for the employer later, especially if participation in the photo or video was then genuinely voluntary.
Another factor in the right to be forgotten will be the ease in which the image could in fact be deleted without damage or cost to the employer, particularly if the objection comes from an employee without a good objective reason for wanting his or her image removed The uplifting effect of a commemorative team photo on the intranet would be significantly marred, for example, if the faces of one or more of them had subsequently been obscured by pixels, a smiley or a big red X (these are not your only options). The same is true in spades in relation to material designed to be distributed externally, but remember that soft copy marketing materials can be more easily and cheaply amended to omit a particular photo than can hard copies already printed in bulk. I have in my room a particularly grim photo of this firm’s Employment team as it stood about 20 years ago, of which I am now the only survivor – no disrespect to any of them, of course, but personally I would be much more concerned if they introduced a right to be remembered.
Does the employee’s motivation for seeking to be forgotten matter, or is the right like a DSAR i.e. equally applicable however genuine or Machiavellian the intention behind it? The right to be forgotten is not dependent on being exercised in good faith or upon the individual being able to show any particular loss or harm from the employer’s continued use of his image, but that will be a factor to be weighed in that balance. As a rule, it will be hard for an employee to show any particularly overriding reason not to be featured as one of a crowd or a background extra in a corporate photo or video even after he leaves. However, if he has a meaningful role in a marketing video for X company, that could be embarrassing for him when he later moves to competitor Y. Similarly, if he discovers after leaving that his employer is riddled with corruption or other reputational hazard, or if the person next to him in the team photo turns out to be a future leader of UKIP, he may well wish to protect himself against harm by any further visible association with them.
Provided that as an employer you can demonstrate that you have properly considered those competing interests, you are unlikely to run into issues with the ICO if an employee’s image is not immediately removed on request. Unless the employee has strong and objective reasons for wanting to be erased immediately, just ensure that you do it when you next can without material costs or inconvenience. You will need to explain your thinking and intentions in this respect in writing to the individual making the request (within 30 days if possible), as this is likely to draw the teeth on any complaint about erasure which he may consider making.
Previous Practical Guidance available: Part 2, Part 3, Part 4, Part 5 and Part 6
