The publication of employee photos or videos by employers is widespread in practice, for example on company websites, social media, in brochures, or even in training videos. From a legal perspective, this typically constitutes the processing of personal data within the meaning of Art. 4(1) GDPR. Accordingly, a suitable legal basis is required for permissible publication.
Legal Basis for Publication
As a general rule, the publication of employee images generally requires the consent of the data subject pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 26(2) of the Federal Data Protection Act (BDSG). Although § 23(1) of the German Artistic Copyright Act (KUG) provides for certain exceptions—such as images from the field of contemporary history, images of gatherings, or when individuals appear merely as incidental elements alongside a landscape or other location—these exceptions generally do not apply in typical scenarios involving the targeted depiction of employees. Publication without their consent is impermissible in such cases.
Requirements for Valid Consent
The requirements for valid consent are strict. According to Section 26(2) sentence 1 of the Federal Data Protection Act (BDSG), it must be ensured in particular that the employee's consent is given voluntarily. A decision is considered voluntary only if the employee is granted a genuine choice and there is no risk of adverse consequences for refusing consent. Consent should be obtained in writing or electronically (Section 26(2) sentence 3 BDSG) and must meet the following minimum requirements:
- Voluntary nature – In the information text regarding consent, the employer should explicitly clarify that no disadvantages under employment law or otherwise will arise from granting or withholding consent.
- Transparency – The employee concerned must be fully informed about the intended use (Art. 13 GDPR).
- Purpose limitation – It must be specifically stated for what purpose and in which locations (e.g., company website, social media, print media) the recordings are to be published.
- Right of withdrawal – The employee must be informed that they may withdraw their consent at any time with future effect (Art. 7(3) GDPR).
Specific Practical Scenarios
- Publication for advertising purposes (e.g., company website, brochures) – Publication for marketing or promotional purposes generally requires particularly careful consent. This must explicitly specify the specific intended use. Consent must not be given in general terms but must be obtained on an individual basis.
- Use on social media (e.g., Instagram, LinkedIn) – When publishing on third-party platforms, employees must be informed of the platform's reach, third-party storage, and potential further dissemination. Consent must also explicitly cover this use.
- Use in training videos or internal presentations – Even internal use constitutes the processing of personal data. Here, too, consent must specify the specific use and the intended audience.
- Termination of the employment relationship – The data protection requirement for publication generally ends when the employee leaves the company. Once the employee has revoked consent, this must be implemented without delay, unless the employer has an overriding legitimate interest in temporary continued use. Legally compliant handling is only possible with clearly defined consent.
Recommendations for Employers
Employers should review existing processes for the creation, storage, and publication of image material and adapt them to data protection requirements, in particular:
- the use of consent forms that meet all legal requirements,
- raising awareness among individual departments (e.g., Marketing, HR) regarding data protection risks,
- the establishment of an internal process for obtaining consent or revocations and for deleting published content,
- the appropriate documentation of consents.
We are happy to assist you with any questions regarding the legally compliant design of consent declarations, the internal implementation of data protection requirements, or the evaluation of specific publication projects.