Personal Data - GDPR
Images and videos may be personal data
Images and videos may be personal data if individuals that are alive appear in the material, and the material is in such cases covered by the GDPR. The same applies to audio recordings that include an individual’s voice. This is especially important for companies to keep in mind, before the company processes personal data in images, videos or audio recordings.
Images and videos can be personal data - What is personal data according to the GDPR?
Personal data means any information which, directly or indirectly, alone or in combination with other data, may be linked to a natural living person. For example, a name, phone number and social security number.
If it is possible to link an image, video or sound recording to a living person, it is also personal data. However, this does not mean that everything contained in the material constitutes personal data. Note that it must be possible to identify the person. In other words, it is possible to blur the face of an individual appearing in an image, or that someone appearing in the image cannot be identified for some other reason.
What if the company cannot identify the person appearing in images, videos or audio recordings?
If a company takes a picture and there are unknown people in the picture, but someone else could identify the people, it still constitutes personal data under the GDPR. It doesn’t matter if the company can identify them or not.
In addition, it may be that an image is too small to be able to read the people in it, but that through technology you can zoom in and thereby more clearly see the people in the image, so it also constitutes personal data.
Can images and videos contain sensitive or other privacy-sensitive personal data?
Yes, images and videos may contain sensitive or other privacy-sensitive personal data. There are four groups of privacy-sensitive personal data in the GDPR, one of which constitutes sensitive personal data. Although the processing of sensitive personal data is prohibited under the general rule in Article 9 of the GDPR, there are some exceptions.
Examples of sensitive personal data are information that reveals an individual's political views. If a person gives a speech in front of a closed group of people and talks about their political views in the speech, and it is possible to link the video or audio recording to the individual, it constitutes sensitive personal data.
Publish images and texts of employees
In some cases, companies want to publish images with descriptive texts about their employees, for example, on the company’s website. It can be sensitive and therefore it may be good to ask the employee for their approval beforehand. However, consent cannot be used as the legal basis for the processing, as the power relationship between the employer and the employee is unequal.
Contracts with data subjects can be an appropriate legal basis for publishing images and texts of employees if it is part of the task, such as for brokers.
The company may have a legitimate interest in publishing images and descriptive texts of employees, if it is common for such roles to have the data published. For example, the people who sit on the company's board of directors or the management team.
Learn more
Processing of privacy-sensitive personal data
There are different categories of personal data that companies can process. The more important the personal data, the stricter the security requirements. There are four groups of privacy-sensitive personal data, two of which are sensitive data and personal data relating to criminal convictions and offences. These two categories are also subject to special provisions of the GDPR, which distinguishes them from the other two categories which are social security numbers and subjectively privacy-sensitive data.