GDPR consent to use of employee’s image

Normally, you can’t rely on an employee’s consent as the lawful basis for processing their personal data. However, using their image in marketing materials can be an exception if they have a genuine choice about whether to consent.

Personal data

Obtaining an individual’s written consent to the processing of their personal data is one way in which you can show that your processing is lawful under the UK GDPR. In relation to special category personal data, one of the additional lawful conditions for processing is where the person has given their “explicit” written consent. An employee’s photo will constitute their personal data if they can either be identified from the image or they’re identifiable using the image alongside other available information. It may also constitute special category personal data as it can reveal their racial or ethnic origin, plus it may reveal their religious beliefs or their physical health.

Conditions for consent

The UK GDPR sets out strict conditions for obtaining consent. It provides that:

• consent must be freely given, specific, informed and unambiguous and it requires a positive statement or active opt-in
• consent must be verifiable
• if consent is given in a written declaration that also deals with other matters, the request for consent must be clearly distinguishable from those other matters
• an individual has the right to withdraw their consent at any time, you must tell them of this right and it must be as easy to withdraw consent as it was to give it
• consent must cover the purpose of the processing and the types of processing activity.

Employment position

The Information Commissioner’s Office (ICO) takes the view that employees can’t generally freely give their consent to their employer, because of the imbalance of power in the employment relationship. So, normally, when processing employees’ personal data, you’ll need to rely on an alternative lawful basis for processing (and on an alternative additional lawful condition for processing special category personal data). However, there are some exceptional cases where it may still be acceptable to rely on the employee’s consent as the lawful basis for processing their personal data (and on their explicit consent in relation to special category personal data). Those cases are where the employee has a clearly genuine choice about whether to consent, without suffering any adverse consequences if they choose not to do so. Using an employee’s image in corporate marketing materials can be one of those exceptions. So, we’ve drafted our GDPR Consent to Use of Employee’s Image.