When capturing and commercially or professionally using an image of an identifiable person, a legal tension arises between two legal frameworks: the classic Belgian personality right to image and the European General Data Protection Regulation (AVG/GDPR). The view that a single consent is sufficient to meet the requirements of both legal regimes is a dangerous fallacy that carries risks for companies. The best legal strategy is to strictly separate the contractual aspects of the image from data protection, ideally basing AVG-compliant use on balanced legitimate interest or contractual necessity, rather than on revocable AVG consent.
The historical and technological context of image law
Since the beginning of time, man has had the intrinsic need to depict himself and his fellow man. From the earliest prehistoric cave drawings to the hyper-connected, digital society of the twenty-first century in which the modern ‘selfie’ is ubiquitous, images are a crucial tool for telling stories, capturing emotions and preserving memories. However, the technological developments of recent decades have exponentially increased the ability, speed and ease of creating, manipulating and distributing images worldwide. A smartphone and an Internet connection are sufficient today to share a captured photo with a global audience in a split second.
Moreover, recent breakthroughs in artificial intelligence (AI) have created a new reality. It is now possible, without the subject ever having physically stood in front of a camera lens, to generate perfectly staged photographs or videos-the so-called ‘deepfakes’-that are hardly distinguishable from authentic material with the naked eye. This significant transformation in the way society treats images has led to a sharpened societal and legal focus on the rights of the individual with respect to capturing and exploiting his or her image.
To each individual comes the fundamental right to decide autonomously what is done with his or her image, as well as the right to exercise control over this use and to resist misuse or unlawful commercial exploitation. Within the Belgian and European legal order, this individual autonomy is guaranteed by a dual and sometimes conflicting system of rules. On the one hand, there is the traditional personality right to image, which has its roots in the protection of human dignity and private life, and on the other hand, there is the modern, highly formal right to the protection of personal data, as codified in the General Data Protection Regulation (AVG).
Whereas protection from personality law has long been anchored in legal tradition and shaped by doctrine and case law over the decades, European data protection law is currently shaped primarily by the strict, preventive and highly formalized provisions of the AVG, which is relatively new and forces organizations to a far-reaching degree of administrative compliance. Since both legal regimes apply fully and simultaneously to the creation and use of a person's image, they also apply cumulatively when parties enter into contractual arrangements regarding such use. This dual scope significantly curtails classical freedom of contract and creates legal pitfalls that, if not properly navigated, can lead to insoluble conflicts and significant financial damages claims.
The personality right to image: the civil law basis
Within Belgian legal doctrine and case law, the right to image is conclusively categorized as a personality right, implying that it possesses all the fundamental properties associated with such rights. Personhood rights are characterized by their universal nature; they belong to every natural person without distinction in life and form the legal protective wall around the individual's humanity.
These rights bear a strictly personal character. This means that they are extrapatrimonial: one cannot definitively renounce them, one cannot sell them, nor are they amenable to transfer or formal gift. As subjective rights, they are absolute, opposable to anyone (erga omnes), and they are immutable.
In essence, the right to image encompasses two indivisible dimensions: a passive protection dimension and an active disposition dimension.
- Protective law: This component enables the individual to take reactive and prohibitive action against the capture, reproduction or publication of his/her image by a third party without valid consent. It provides the legal basis for claims for injunctive relief or damages for infringement.
- The right of disposal: This active dimension, which is crucial to commerce and the media sector, empowers the titular holder to actively and contractually allow third parties to exploit the image, obviously under the specific terms, modalities and fees dictated by the titular holder. It is this dimension that underlies contracts between photographers and models, or licensing agreements in which a well-known top athlete or actor grants a brand permission to use his or her image to promote products or services.
Although portrait law in Belgium is primarily a creation of jurisprudence-a legal framework sculpted by judges on the basis of the general right to privacy-it has specific aspects with an explicit legal foundation. The most prominent and structural provision is found in Article XI.174 of the Code of Economic Law (WER). This provision states in clear terms that the author of a portrait, or its owner or possessor, does not have the right to reproduce or communicate this work to the public without the express consent of the person portrayed.
The broad definition of the image and the criterion of recognizability
The substantive scope of the personality right to image is extremely broad. It protects the representation of a person's physical appearance in the broadest sense. The prevailing legal doctrine uses a comprehensive definition, defining an image as the representation of the image of a person by means of any pictorial technique, mimicry, disguise or imitation, captured in a material or immaterial manner. In other words, the law applies to any representation as long as the person in question is recognizable.
It is a common fallacy to assume that protection is limited to a clear depiction of the face. Case law invariably confirms that the depiction of any recognizable body part, a typical and unique body posture, a specific silhouette, a drawn caricature or even the use of an intentional ‘lookalike’ is sufficient to trigger the right to depiction. Recognizability is the absolute key in assessment, and may derive directly from the visual properties of the image itself, or indirectly from a combination of the image and the broader context in which it was taken or disseminated.
Belgian and international case law offers numerous, fascinating examples of this broad interpretation of recognizability :
- Tattoos: An image showing merely an unrecognizable part of the body, but showing a tattoo that is unique and distinctive to the wearer, is fully covered by the right to depict the tattooed person.
- Actors and reconstructions: A prisoner can successfully invoke his right to images for images of a forensic reconstruction of his escape attempt, even if the images use an actor who merely portrays the prisoner.
- Commercial lookalikes and redeemable popularity: In a well-known lawsuit, the management of well-known Formula One driver Max Verstappen received substantial damages for the violation of his right to image. A company had used a lookalike for commercial purposes. In such cases, case law takes into account the concept of ‘redeemable popularity’-the financial and commercial interest that public figures have in the exclusive exploitation of their name recognition and image.
- Contextual identification: The Brussels Court of First Instance ruled on a case in which a woman was filmed by a hidden camera crew while she was in a café having a private conversation. Although her face was presumably partially out of focus or indistinct, it was held that she was unmistakably recognizable through the combination of her specific hair color, her distinctive attire and the fact that the audio of the recording showed that she was from Mechelen.
- Deepfakes: Contemporary phenomena such as deepfakes-where algorithms are used to generate a synthetic image or video of an existing person that is indistinguishable from authentic material with the naked eye-fall unabated within the scope of personality rights.
The conditions for contractual consent under portrait law
When parties contract about the exploitation of an image through the active right of disposal, the fundamentals of a legally valid consent must be closely observed. The lawful use of a person's image rests exclusively on the basis of the consent of the person depicted. This consent must meet four cumulative requirements: it must be prior, free, express and certain.
Although in principle there are no mandatory formal requirements-consent is free of form in the legal sense and can thus be perfectly oral or even tacitly granted-it is always advised from an evidentiary and risk-limiting point of view to draw up a written agreement or quit claim. After all, the one who uses the image and claims the existence of consent always bears the full burden of proof regarding the existence and exact scope of such consent.
The concept of free and tacit consent
A “free” consent implies that the consent was given without any external pressure, coercion or defects of will (such as mistake or deceit). Within the personality law regime, case law generally assumes that the mere presence of a relationship of authority, such as the structural subordination that characterizes the relationship between an employer and an employee, is in itself insufficient to automatically conclude that consent would not be free. This is a crucial distinction from later European data protection law.
In the absence of a written document, a judge may infer the existence of tacit consent from the totality of the factual circumstances. In such a case, the behavior of the person depicted must be so unambiguous that no other rational conclusion is possible than that consent was given to the targeted use. A classic example is the case law surrounding Dutch soccer coach Reijers. After a statement of his went viral, his image was used on T-shirts and websites to promote it. The court found that the trainer had not only failed to protest in a timely manner when he became aware of the use, but that he also adopted a friendly and encouraging tone towards the operators in email communications, and even willingly posed for a promotional photo with a bottle of champagne on which the protested image was used. The court correctly found that this combination of actions demonstrated an unambiguous, albeit tacit, consent.
In addition, the law includes a presumption of implied consent for certain well-defined categories of professional actors, such as photographic models, famous artists and professional athletes. When they allow themselves to be photographed for commercial purposes as part of their normal professional activity and for a fee, it is presumed that they implicitly consent to the standard commercial use of those recordings.
The dogma of restrictive interpretation
One of the main legal anchor points in contracts around portrait rights is the principle of restrictive interpretation. Any consent, whether express or implied, must be interpreted extremely restrictively and literally in favor of the person ceding his or her personality rights. In essence, the consent should be sufficiently specific and delineated. A general, unlimited “blank” permission allowing an image to be used “for any purpose and on any media, indefinitely” is considered null and void.
Consent shall remain exclusively and compulsorily limited to the purpose, territorial scope, scope and duration for which it was initially given. Some concrete applications of this restrictive interpretation illustrate the rigor of this principle:
- The permission granted to a photographer to photograph or film someone in no way implies permission to subsequently publish or commercially distribute those images. Capturing and publishing require two separate and specific permissions.
- When a person consents to the distribution of their image to a specific and defined audience (for example, the subscribers of a local magazine), this never constitutes consent to distribution to another, broader audience (such as publication on a freely accessible Internet platform or national television).
- In the context of an employment relationship, an employee's consent to have his photograph used for a private internal staff magazine in no way implies that the employer is entitled to subsequently recycle that same photograph, without new consent, for a large-scale, external promotional calendar distributed nationwide.
In contractual practice, parties must consistently negotiate a new and specific consent for each new or different form of exploitation that falls outside the initial expectation. Within long-term contractual relationships, such as an employment contract or a multi-year design contract, although parties may negotiate a specific framework agreement granting a general consent for the duration of the contract for well-defined categories of use within a fixed context, even such a general consent may not be limitless.
Special rules: minors and deceased persons
Specific protection regimes apply when the person portrayed is a minor or a deceased person. In the case of minors, Belgian law provides that the parental authority is primarily responsible for exercising contractual rights. Consequently, the parents or legal guardians must give their express consent. However, once the minor reaches an age at which he or she is deemed capable of possessing sufficient discernment to grasp the scope of the publication-a limit often drawn in legal practice around the age of 12, depending on maturity-the personal consent of the minor is also required, in addition to that of the parents.
In addition, the right to image does not immediately extinguish at the time of the individual's death. Belgian law and case law generally accept that the right to image post-mortem continues for a period of twenty years after the death of the person portrayed. During this period, the right of disposition shifts and any intended exploitation of the image must be submitted to the legal assigns or heirs for approval.
The unique and strict right of withdrawal (right of withdrawal)
One of the most controversial and complex aspects of the personality right to image is the unilateral right of revocation. Because human personality is indivisible and inalienable, the holder always retains the sovereign right to revoke a previously validly given consent. Any contractual provision definitively waiving this right of withdrawal in advance disregards the protection of a fundamental right and is considered absolutely null and void.
However, this inalienable possibility of withdrawal is very much at odds with one of the foundations of civil law: the general principle of law pacta sunt servanda, which dictates that validly concluded agreements become the law of the parties and must be strictly complied with. To avoid outlawing economic actors and the media sector and evaporating any legal certainty in commercial licensing contracts, case law has imposed a series of extremely strict, cumulative limitations and conditions on the effective exercise of this right of withdrawal :
- The requirement of serious reasons: A revocation can only be legitimized by the statement of objectively serious and weighty motives. These motives may not be based purely on purely proprietary or financial considerations (for example, the desire to sell the rights elsewhere for a substantially higher fee). Nor does subjective dissatisfaction with the aesthetics, the lighting or the final end result of a photo shoot constitute sufficiently serious grounds. Serious cause generally arises only when the continued performance of the contract, due to drastically changed personal circumstances in the life of the holder, would seriously affect that person's dignity, honor, good name or social reputation, to such an extent that the operator's adherence to the contract would constitute de facto abuse of rights.
- Balance of interests and burden of proof: The party seeking revocation bears the heavy burden of proof to show that its personal and moral interests outweigh, in the circumstances, the operator's commercial interests and the societal interest in contractual legal certainty. If, in addition to commercial motives, the operator can also invoke other fundamental rights-such as the right to free speech, artistic expression or the social right to information-the court will assess the demand for revocation with even greater rigor and restraint.
- Prohibition of censorship and timely notification: The exercise of the right of withdrawal must never have the effect of circumventing or neutralizing the fundamental democratic prohibition of preventive censorship in a covert manner. Also, notice of termination or revocation by the holder must be given to the operator in a timely manner, the timeliness being judged by the standard of conduct of a normally careful, prudent and foresighted person.
- Ex nunc effect and indemnification only: If the court finds that the withdrawal is legitimate, this decision merely sorts out future effects (ex nunc); already completed publications or disseminations do not become retroactively unlawful. Moreover, the principle of fairness (enshrined in the Civil Code) dictates that the party withdrawing its consent is obliged to provide full financial compensation to the terminated operator for costs actually incurred and objectively provable (the damnum emergens) resulting from the early termination of operations.
The image as personal data under European law (AVG)
Whereas image personality law has traditionally focused on civil relationships, interpersonal integrity and the concept of ownership around the human image, European lawmakers are introducing a fundamentally different, data-driven paradigm with the General Data Protection Regulation (GDG or GDPR). The right to the protection of personal data has since become an autonomous and fully-fledged European fundamental right, recognized by the Treaty on the Functioning of the European Union (TFEU) and the EU Charter of Fundamental Rights.
The AVG has been in effect since May 2016 and serves as the comprehensive legal framework for processing personal data. It aims to maximize uniformity within the internal market and ensures that individuals retain far-reaching control over their personal information. The regulation applies in full to any fully or partially automated processing of personal data, as well as to the manual processing of data structurally stored in a file.
A photographic or audiovisual image unquestionably and consistently qualifies as personal data, within the meaning of Article 4.1 of the AVG, provided that it provides information about an “identified or identifiable natural person” (the data subject). It is important to make the terminological distinction with portrait law. Whereas the application of the personality right is imperatively guided by the concept of identifiability (the ability to visually recognize the person based on the image itself or the context), the AVG places the focus solely on identifiability.
Identifiability can be direct or indirect. A photograph in which a person is visually portrayed completely unrecognizable, but in which a vehicle license plate is perfectly legible in the background, will not fall under the strict rules of portrait law (due to the lack of physical identifiability), but does fall under the extremely strict scope of the AVG without fail. Indeed, through the linking of the license plate with other databases, the owner of the vehicle can be indirectly and unambiguously identified.
When one digitally stores, consults, structurally collects in a folder, publishes via automated processes on the Internet, or transmits such an identifiable image, this establishes “processing” in accordance with Article 4.2 of the AVG. From then on, the obligations and administrative sanction mechanisms of the Regulation rest with the data controller.
The complex question of qualification: regular or special (biometric) personal data?
Within the doctrine of the AVG, it is important to make a sharp and precise distinction between ‘regular’ personal data and ‘special categories of personal data’ (also known as sensitive data). Article 9 of the AVG implements a principle prohibition on the processing of data revealing racial or ethnic origin, political or religious opinions, health, sexual orientation or biometric identification. Only in very exceptional cases, such as when obtaining an explicit, informed and freely given consent, can this principled prohibition be broken.
A strict reading of this article creates an existential crisis for the use of photography and imagery. After all, due to the nature of the medium, a typical photograph almost always immediately reveals a person's skin color and presumed origin, and often reveals details about health (such as wearing medical devices or a wheelchair) or religious beliefs (such as wearing a yarmulke, headscarf or cross). In a July 2023 ruling, the European Court of Justice (ECJ) stated that the processing of special personal data remains prohibited regardless of the intention of the controller. An extreme extension of this ruling could imply that the vast majority of portrait photographs invariably fall under the drastic prohibition regime of Article 9 AVG, which would make the implementation of, for example, security cameras or large-scale commercial photography impossible without explicit written consent from every casual passerby.
To avoid this unworkable and undesirable outcome, the European legislator explicitly included Recital 51 in the AVG. This recital categorically states that the processing of ordinary photographs or camera images should not be systematically equated with the processing of special categories of personal data. An image is legally transformed into protected “biometric data” only when the photograph is subjected to and processed using specific, advanced “technical means” aimed at enabling the unique, flawless identification or automated authentication of a natural person.
The assessment is thus inextricably linked to the purpose and accuracy of the specific use. According to supervisory guidelines, such as those issued by the Dutch Personal Data Authority, a regular photograph of a person does not fall under the strict rules for biometric data if three cumulative conditions are met:
- The image is not primarily aimed at capturing the special or sensitive aspects, nor at making automated distinctions based on these specific data.
- It is not reasonably foreseeable to the party driving the processing that third parties will make discriminatory distinctions based on these images.
- The mere capture of the particular personal data in the image is an unavoidable, logical and inherent side effect of photographing the person.
Consequently, images taken from standard video surveillance cameras, commercial photo shoots or mood photography at events are treated as ‘ordinary’ personal data unless one purposefully starts using AI-driven facial recognition or advanced biometric templates.
The fundamental zone of conflict: The irreconcilability of consent
When processing an image that qualifies as regular personal data, the AVG imposes an absolute requirement: the processing must be based on a lawful, transparent basis. Every controller must base the processing on at least one of the six exhaustively listed legal grounds in Article 6 of the AVG (consent, contractual necessity, legal obligation, vital interest, public interest or legitimate interest). It is essential to identify this legal basis prior to processing, communicate it clearly in a privacy notice, and enforce it consistently. An organization cannot for security purposes designate multiple bases for the same processing purpose, or seamlessly switch to another basis if the primary basis should suddenly expire or prove ineffective.
When entering into agreements about the use of someone's image, many businesses and legal professionals experience the intuitive urge to base use under the AVG on “consent” as well. Since one must already obtain the consent of the individual in order to resolve the claims of the personality right on image, this seems a logical and efficient solution. However, this reasoning poses a legal minefield.
The conditions, definitions and legal mechanisms behind consent under civil law portrait law, on the one hand, and consent under the administrative law AVG, on the other, differ to such an extent that coordinated, simultaneous application of the term “consent” in practice often leads to absurd and unjust results.
Analysis of structural asymmetry
To chart the depth of this legal quagmire, the view below provides an analytical comparison between the essential parameters of the two concepts of consent :
| Legal Component | Consent under Personhood Law (Portrait Law) | Consent under Data Protection Law (AVG) |
| Validity and form requirements | Essentially form-free. A tacit consent can be perfectly validly inferred from the data subject's passive behavior or refusal to resist in a specific context. | Active action is an absolute necessity. Any form of tacit consent, inaction, or acquiescence via pre-ticked checkboxes is deemed invalid and void. |
| The claim of “freedom” | Consent must have been given without will or unlawful coercion. A professional subordination, such as a relationship of authority between employer and employee, is not in itself sufficient to conclude that consent would be involuntary. | Consent must be absolutely free. The individual must have an actual choice and must not suffer any disadvantage for refusal. In relationships with a strong power imbalance (such as employer-employee), free consent is almost categorically ruled out. |
| Integration into contracts | Consent often encompasses the essence or core purpose of the contract (e.g., in the case of models and athletes) and may be inseparable from other contractual performance. | Consent is generally not “freely” given if the performance of a contract is made dependent on the consent, when such processing is not strictly necessary for the effective provision of services (Article 7.4 AVG). |
| Information obligation | Relatively flexible, as long as the objective and scope are sufficiently specific and defined over time. Limited mostly to the mere context of exploitation. | Extremely exhaustive and formalistic information obligations (Art. 13 and 14 AVG). The identity of all responsible parties and third-party recipients, exact retention periods, all specific partial purposes and the explicit mention of the right of withdrawal must be provided in advance. |
| Right of withdrawal and revocation | Highly exceptional and rigorously assessed to ensure contractual certainty. Requires the statement of objectively “serious reasons,” involves a balancing of interests, and creates the compelling obligation to pay incurred operating costs (the damnum emergens) to be reimbursed. | The right to withdraw consent at any time, with immediate effect is unconditional and sacred. No statement of reason is required, the method of withdrawal must be as simple as giving the consent, and the individual is in no way liable for financial damages or compensation. |
This asymmetry, and more specifically the gap on the modalities for revoking consent, is the biggest threat to commercial contracts. Imagine an extremely expensive, international advertising campaign in which a company prominently deploys the image of a model after the conclusion of a contract. If the processing of those images under the AVG is based solely on the basis of ‘consent,’ the model can revoke this AVG consent at any time via a simple mouse click. Under the rules of the AVG, the model does not have to give any, let alone a serious, reason for doing so, and the company has no right to recover the paired gigantic production costs from the model.
At that precise moment, the legal basis for further use of the image material abruptly disappears. Any further storage or disclosure immediately results in a data protection violation. In such cases, the AVG regime overrules civil contractual intentions, completely disrupting the commercial agreements made through portrait rights, rendering them unenforceable and causing the operator's investments to go up in smoke.
AVG bases for preventing destructive conflicts
To avoid such unjust and financially disastrous situations, it is necessary for the contracting party that will exploit the image to base the processing of the image within the regime of the AVG not on ‘consent,’ but on a firmer processing basis. To this end, the AVG provides two specific and appropriate alternatives.
1. Necessity for the performance of a contract (Article 6.1.b AVG)
For contracts where the use of likeness is the absolute core, fundamental object or ‘raison d'être’ of the transaction, this processing basis is by far the safest choice. Examples include classic agreements between photographers and paid photographic models, or large-scale commercial merchandising agreements in which an entity markets specific products bearing the image of a well-known or popular figure. In such scenarios, the contract logically cannot be established nor materially performed without actual processing of personal data (in this case, the image). The processing is objectively indispensable to realize the contractual commitments.
The advantage of using this basis is the elimination of the arbitrary AVG right of revocation. Since the processing is not based on consent, the person depicted cannot torpedo the further course unilaterally and with impunity by invoking data protection law. If the person decides that one wants to discontinue the cooperation, he must respect the classic provisions of contract law. Consequently, any breach of contract will be dealt with according to the law of obligations, whereby the obligation to pay damages remains unimpaired and the other party can seek to recover its investments financially.
However, it is important here to state explicitly and clearly from the outset in the contract that the processing of the image is necessary for the performance of the contract, and to specifically designate this as the basis in the register of processing activities. One should not retroactively revise or optimize the contractual commitments and the AVG policy when a dispute arises.
2. The balanced legitimate interest (Article 6.1.f AVG).
In numerous contexts, while the use of an image is extremely useful, functional and logical, its processing is not strictly and objectively “necessary” in the sense that the main contract could not possibly exist without such processing. One thinks of an employer publishing the photograph of an executive or employee with a public-facing commercial function on the company website. In such edge cases, the legal basis of legitimate interest, based on Article 6.1.f of the AVG, offers a valuable and proportional alternative.
However, the application of this basis requires the controller to proactively conduct and document a three-step test or proportionality analysis:
- The legitimate objective: The company or institution must pursue a real, present and legitimate interest that is not impermissible under legal or regulatory provisions. In recent case law, the European Court of Justice, specifically in the KNLT ruling of October 4, 2024, significantly clarified and relaxed the criteria. The Court ruled that the requirement of a “legitimate interest” is not exclusively limited to matters directly anchored in law (such as crime prevention or network security), but that any interest can be legitimate, provided it is shown to be consistent with law through a “negative test.” This implies that a pure, pursuing commercial interest of a corporation or sports federation also qualifies as a valid basis under this definition.
- The necessity requirement: The specific processing must prove to be effectively necessary to achieve the legitimate aim pursued. This implies that the legitimate interest cannot reasonably be achieved as effectively through other tools or mechanisms that have a substantially less intrusive effect on the fundamental rights and individual privacy of the photographed data subject.
- The balancing requirement: The interest of the processor must be systematically weighed, taking into account the very specific and concrete factual circumstances, against the fundamental fundamental rights, freedoms and objective interests of the individual who figures in the image. One must expressly take into account the theory of reasonable expectations in this weighing process: could the individual in question, at the time of the inclusion and in light of the relationship with the data controller, reasonably and objectively estimate that his image would be exploited for this exact purpose? In the KNLTB judgment, the European Court stressed that sharing data for commercial purposes (such as with gambling companies) is quickly found to be impermissibly disproportionate and harmful if it exposes data subjects to serious personal risks. However, if the risks are minimal, the European Court does not rule out that the fundamental European right to freedom of enterprise may outweigh the individual privacy concerns of a depicted individual who later protests.
A significant difference from the processing ground consent is the modality for objection. In accordance with Article 21 AVG, the depicted person always retains a right to object to processing based on legitimate interest. However, in essential contrast to the absolute and blank withdrawal of consent, the AVG mandates that this objection must always be formulated with specific reasons, related to the individual, personal and unique situation of the data subject. If the company receives such an objection, it has the legal space to nevertheless continue processing if it can prove compelling and overriding legitimate grounds that outweigh individual dissatisfaction. This particular mechanism reflects substantively and materially strongly the considerations and standards used within the dogmatics of personality law for rejecting an unjustified revocation (the “serious grounds”). In this way, this AVG basis ensures that both legal regimes continue to operate in each other's waters and in constructive symbiosis.
A hot topic: images in the workplace and after leaving employment
One of the most frequent and legally challenging scenarios for companies concerns the management and publication of images of their own staff. Employers regularly deploy portrait photos of employees on the corporate website, on the internal intranet (such as Chromebooks), in recruitment campaigns (employer branding) or through the company's social media channels.
As explained in the analysis above, attempting to legitimize the use of employee photos under the rubric of “consent” (within the meaning of the AVG) constitutes an irresponsible and legally incorrect reflex. The absolute inequality and functional hierarchical dependence that characterizes labor law implies that the employee may always experience some pressure. If the employee is presented with a document for consent, its validity is immediately in question, unless refusal would demonstrably lead nowhere, in no possible way, to retaliation or subtle disadvantages in career development.
For this reason, regulators across Europe recommend that employers direct the display of photos on the “legitimate interest.”. Publishing images of a spokesperson, an account manager or a member of management is necessary for proper company representation and service. But even here, there is a requirement to inform employees in detail about the nature of the publications in advance, as well as to facilitate the concrete exercise of their right to object or erase.
Data Protection Authority decision 62/2021: A compelling lesson
The most serious problems present themselves at the tipping point of the file, particularly on the day the contractual obligation ends. The lawful processing of photos does not stop after the conclusion of an agreement, but is subject to data retention and purpose limitation throughout its life cycle. On this precarious subject, the Belgian Data Protection Authority (GBA) has sent a loud and clear legal signal regarding former employees in a decision dated May 26, 2021.
In this directional case, the complainant was employed by a private company, where she left employment via resignation in 2020. Through her attorney, the individual informed the company that her identity, personal information, as well as several representative photos needed to be removed from the official company website and from accounts on external social media networks. The facts showed that, at the time the initial complaint to the GBA was acted upon, the employee had already been out of service for three months, and that after no less than eight months, certain photos (including group compositions) were still online and freely consultable.
The GBA Disputes Chamber issued an extremely harsh, detailed condemnation and warning to the employer. The authority pointed to fundamental obligations in the AVG, in particular the principle of purpose limitation. The authority ruled starkly: as soon as a staff member loses or terminates his or her position, the initial primary purpose for publishing the data-namely, to correctly and transparently inform the outside world about the actual representation of the company-immediately and completely ceases to exist. Case law shows that personal data in such contexts must be deleted immediately and ex officio. Moreover, the data subject should not proactively, or through lawyer, submit the deletion request; the company should structurally purge the file. The reprehensible behavior of allowing data to flourish on the pages for up to three to eight months was characterized as “excessive and inadequate.”.
This Decision illustrates that employers and HR managers need to outline proactive ‘offboarding’ processes, invariably linking the removal of the employee from the organizational chart to the purging of the website and intranet. Failure to carry out such processes or structurally ignoring the statutory one-month response period (Article 12.3 AVG) potentially results in penalties, periodic penalty payments and fines for the affront to the right to oblivion.
Nuanced exceptions: journalism and public events
No fundamental law functions in an institutional vacuum. Where absolute adherence to the individual AVG consent requirement would stifle journalistic speech and mainstream society, legal doctrine and legislation provides escape mechanisms and nuances.
In situations where individuals happen to appear in the background or in an insignificant role in images taken in public places or public gatherings-so-called non-targeted or ‘mood’ images-explicit consent is not necessary to preclude unauthorized dissemination. Accidental and incidental occurs when the individual portrayed is absolutely not artificially or intentionally magnified, highlighted, and thus does not occupy a central or distinctive position in the frame. It is sufficient at events, school parties or events that the organization informs attendees through a transparent policy, the website or clear warning signs at the venue that such atmospheric overlay images will be produced. Only if the organization would subsequently zoom in or create a crop on a specific person would a portrait reappear and the right of consent would apply without prejudice.
A second exception to the strict provisions of the image law, is founded on the European defense of democratic press freedom (Article 10 ECHR). To facilitate debates related to the general societal or artistic interest, the AVG, through its mandatory implementation in national legislation, has a comprehensive exemption for processing with exclusively journalistic, academic, artistic or literary purposes. In these cases, the societal interest to gather news acts as justification, whereby a weighty proportionality test or balancing of interests must be carried out systematically. In doing so, a judge will invariably look at the intrinsic newsworthiness of the subject matter, as well as the personal nature of the figure depicted; politicians and prominent public and economic leaders are accorded an extremely modest expectation of privacy as long as the depiction relates to their public actions and does not descend into pure, intimist privacy or defamation.
Abuse of law in mobilizing AVG rights
The far-reaching legal protections that the AVG throws in the lap of individuals can, in exceptional but undeniable cases, be used as a means of pressure to obstruct valid contracts, dispute invoices, or, out of sheer chicanery, saddle an organization with legal headaches. If an individual throws the powerful provisions of the regulation into the fray solely for the sake of malicious wrangling, and the withdrawal of “consent” serves only to inflict enormous commercial damage or financial loss (a disproportionate disadvantage) at a competitor, former employer, or operator, the academic question arises whether the data controller should suffer this uninhibitedly.
Here the historical foundation of contract law offers salvation. Like any subjective law, mobilizing AVG rights can qualify as ‘abuse of law. The abuse of a right manifests itself if the person uses the mechanism for an intrinsically different end goal than that originally targeted by the European legislature, or if he or she exercises it in an abrupt, disproportionate and manifestly unreasonable manner in which the personal benefit to be gained is inferior to the significant economic destruction inflicted on the other party.
Within a revolutionary and groundbreaking ruling by the Court of Cassation, it was explicitly confirmed for the first time at that level that the Belgian prohibition on abuse of law lends itself perfectly to tempering unreasonable excesses of mandatory European provisions (including the unlimited AVG right of inspection or withdrawal of consent). The top magistrates expressly ruled that the national prohibition on abuse of law does not result in curtailing or dangerously frustrating the goals of the Union, but on the contrary purifies the regulation of chicanery.
While judges in Europe naturally exercise extreme restraint in curtailing the fundamental right to data security and award the label “abuse of law” exceptionally rarely, this Supreme Court ruling is the ultimate proof that the regulation does not function as a lawless free-for-all for the individual. A malicious, vexatious and totally arbitrary invocation to interfere with a lawful contract for revenge can effectively be declared unlawful.
Frequently Asked Questions (FAQ)
Is there a requirement to have a written document signed with each photograph each time?
Although Belgian law and case law nowhere explicitly state that a written contract is an absolute formal obligation, in a professional or commercial context it is almost imperatively advised. Indeed, personality law accepts, under well-defined factual and contextual conditions, the thesis of tacit consent, but also stipulates the principle of restrictive interpretation. Without a written quit claim or model agreement, the entity that publishes invariably bears a great burden of proof in the event of litigation to unquestionably substantiate why the specific purpose of dissemination was included in the consent.
Does every passport photo or portrait photo we take fall under the strict biometric data rules?
This is a pertinent misconception. In accordance with the clarifications in recital 51 of the AVG and the applicable guidelines of the Data Protection Authority, a photograph is not classified as special personal data (biometric data) merely because of the representation of physical characteristics, skin color, medical attributes or race. The transformation into biometric data-which then requires extremely strict processing-occurs only if the photograph is subsequently processed with targeted and specialized technical software and extraction systems (such as AI-driven facial recognition algorithms) with the unique primary purpose of individual automated identification.
What should a company do with published group or portrait photos of a former employee?
As soon as an employee is no longer associated with the organization, in principle, the legitimate finality of transparent business information immediately ceases and the processing ground (usually the legitimate interest) falls away completely. Following the data retention principle in the AVG and the enforcement decisions of the Data Protection Authority, this implies that photos, identity data and profiles of former employees must be immediately, consistently and voluntarily rendered invisible on corporate websites and the company's various Internet applications. Negligence, especially when ignoring the one-month deadline after request, consistently results in punitive sanctions and the award of formal warnings.
Conclusion
The seamless embedding and rollout of commercial imagery and portrait rights within the frameworks of European data protection law requires a huge dose of anticipation and contractual ingenuity from companies, media organizations, HR departments and communications agencies. Incorrectly assimilating a contractual consent from personality law with the revocable consent from Article 6.1.a of the General Data Protection Regulation can result in the complete disruption, blocking and financial decimation of an expensively paid promotional or marketing strategy. One should design contracts watertight by systematically bringing in different and significantly firmer processing bases, such as the balanced legitimate interest and encapsulate a conclusive data retention policy for former staff in the organic processes.
Dutch 
English