It will always be useful to look at any agreement/policy which spells out what is to happen to such material once someone’s employment comes to an end. In the absence of these, arguably the images belong to the employer if they were created with the employee’s consent during the course of their employment.
However the images are also likely to be ‘personal data’ under the Data Protection Act (DPA). As such, an employer must then comply with the 8 principles under the DPA. Generally, this requires fair and lawful processing. A withdrawal of consent by a former employee may mean that it is no longer fair to process the material unless an employer can justify doing so on other permitted grounds under the DPA, such as the processing is necessary:
- To perform a contract with the employee;
- To comply with a legal obligation of the employer;
- To protect the vital interests of the employee;
- For the administration of justice or the exercise of functions of a public nature; or
- For the purposes of legitimate interests pursued by the employer.
In practice, whilst not impossible, it may be difficult for an employer to justify (as a necessity) the continued processing of promotional material for which consent has been withdrawn.
In addition, the General Data Protection Regulation (GDPR) is due to come into force on 25 May 2018. It extends individuals rights over how their data is processed. Employees will have enhanced rights to, for example, erase, restrict, object and to rectify data held about them
The ICO’s guidance on the GDPR can be found here.
You're on our blog and updates site, which is hosted by elXtr, a leading digital hub powered by the award-winning lawyers at LHS Solicitors LLP.
Bringing you real law made easy. Law for the online generation starts here.
The GDPR will apply in the UK from 25 May 2018. The government has confirmed that the UK’s decision to leave the EU will not affect the commencement of the GDPR.