Employee photos on the website and social media

In practice, an employee’s photo can safely be published on the company website, on social media or in advertising only with the employee’s consent. This follows not only from the GDPR. The Civil Code separately provides that a person’s photo may be displayed and printed only with their consent (Article 2.22(1) CK). When the employee withdraws consent, or the period stated in the consent ends, for example the employment, the photo must be removed from the website and the company’s accounts.

Why consent works here although it almost never works in employment, we explained in our article on employee consent. This article covers how the two laws work together, which consents fail and what happens when the employee leaves.

Two laws, two questions

The Civil Code protects the image. A natural person’s photo, portrait or other image may be reproduced, displayed and printed only with their consent (Article 2.22(1) CK). Consent is not needed where this is connected with the person’s public activity, their official position, a requirement of law enforcement authorities, or where the photo is taken in a public place. Even then, the photo may not be displayed if that would demean the person’s honour, dignity or professional reputation (Article 2.22(2) CK). This article applies regardless of the GDPR. As of 24 September 2026, the future editions of the Civil Code published so far, taking effect on 27 September 2026, 9 December 2026 and 1 November 2027, do not change it.

The GDPR protects the data. A photo in which a person can be recognised is personal data, because it is information about a person who can be identified (Article 4(1) GDPR). Publishing it needs a legal basis under Article 6(1) GDPR. In our view, for a company website or account, that is almost always consent (Article 6(1)(a) GDPR).

A practical conclusion follows. Even if someone tried to base publication of a photo on legitimate interest under the GDPR, the Civil Code requirement does not go away. Consent under Article 2.22 CK is still needed, unless one of its exceptions applies.

The exception for official position needs care. Whether it covers an ordinary employee’s photo on a team page, the text of the law does not say directly. In our view, relying on it instead of consent is risky.

Name, job title and work contacts are a different question. In our view, when an employee’s job is to deal with clients, their name, job title and work email can often be published on the website on the basis of legitimate interest (Article 6(1)(f) GDPR), because clients need to know whom to contact. This works only where publication is necessary for that purpose and the employee’s interests do not override the company’s, so that assessment must be made and written down. Public authorities performing their tasks cannot use this basis. A photo is rarely necessary for this, so the photo still needs consent.

Which consents fail

One company asked us to draft an employee’s consent to use their image in company visuals. Later it also wanted consent to align employees’ personal social media profiles with the company’s style. In both cases the consent was set out in a separate document. In the second case it also matters that the profile belongs to the employee, not the company. So refusing must have no consequences at work.

Below are four versions of consent that may not hold up.

“For all purposes, forever”. Consent is given for specific purposes (Article 6(1)(a) GDPR). A team page, an advertising video and a printed leaflet are different purposes. One general sentence such as “I agree that the company may use my image” does not let the person choose. When consent is valid, and when it is not, is covered in Consent under the GDPR: when you need it and when it is invalid.

A notice at an event. A notice saying that by attending an event people agree to be photographed is not consent. Silence or inactivity is not consent (Recital 32 GDPR), and the EDPB adds that merely continuing to use a service cannot be regarded as consent either (paragraph 79 of Guidelines 05/2020). Coming to an event does not change this rule. Such a notice informs, but it does not create a basis. In our view, a closed company event is usually not a public place in the sense of Article 2.22(2) CK either; the Code does not define the term.

Consent that cannot be refused. The EDPB gives an example: a film crew is filming in an office, and the employer asks employees for consent. The EDPB presents this as an exceptional situation in which an employee’s consent can be free: those who do not want to be filmed are not penalised in any way and get equivalent desks elsewhere in the building while filming lasts (paragraphs 22–23 of Guidelines 05/2020). If refusing is not possible in practice, there is no consent.

A sentence saying nothing has to be removed after withdrawal. A form may state that if consent is withdrawn, the company does not have to remove material already created. Such a sentence does not override the Regulation. Consent can be withdrawn at any time, and it must be as easy to withdraw as to give consent (Article 7(3) GDPR). Where consent is part of a document that also covers other matters, no part of it that infringes the Regulation is binding (Article 7(2) GDPR). After withdrawal, the photo may stay published only on another basis, and there usually is none (Article 17(1)(b) GDPR).

What happens when the employee leaves

It depends on what the consent says. If the period of the consent is tied to the employment contract, meaning the photo is used until consent is withdrawn or until the employment contract ends, the basis ends when the employee leaves.

Data is kept no longer than needed for the purpose (Article 5(1)(e) GDPR). A photo on a team page of someone who no longer works there has no purpose. It must be removed from the website, the accounts and any advertising still in use.

Printed materials already distributed are a different case. What was done before consent was withdrawn remains lawful (Article 7(3) GDPR). In our view, the same applies when the consent period ends: processing done while the consent was valid remains lawful. So leaflets already handed out do not have to be recalled, but do not hand out remaining stock and do not print new ones with that photo. This matches the EDPB’s general rule: earlier operations remain lawful, but the processing must stop, and without another basis the data must be erased (paragraph 117 of the guidelines).

A separate question is old social media posts. If the consent was valid only during employment, old posts also lose their basis once the employment ends. If you want to keep them, the consent must say so clearly, and the person can still withdraw it. Then the data must be erased if there is no other basis (Article 17(1)(b) GDPR). If the photo was made public and must be erased, the company, taking account of available technology and the cost, must take reasonable steps to inform other controllers processing that data that the person has asked them to erase links to the photo and its copies (Article 17(2) GDPR).

The risk: what happens when a photo stays without a basis

The first risk is a lawsuit. A person whose right to their image has been infringed can ask a court to stop those actions and to award compensation for pecuniary and non-pecuniary damage (Article 2.22(3) CK). Under the GDPR they also have the right to compensation for material or non-material damage (Article 82(1) GDPR).

The second risk is a complaint to VDAI. A former employee who is already in a dispute with the company may start with a request to remove the photo. Such a request must be answered without undue delay and in any event within one month; where necessary, taking into account the complexity and number of requests, the period can be extended by two further months, with notice and reasons given within the first month (Article 12(3) GDPR). In our view, a simple request to remove one photo will rarely justify an extension. An unanswered request becomes a separate infringement (Articles 12(3) and 83(5)(b) GDPR). How a complaint is handled is described in our article complaint to VDAI: how long it takes and what happens next. What to do when data is published without consent is covered in Personal data published without consent: what to do and what to demand.

The third risk is fines. Processing without a proper basis and infringing the conditions for consent fall in the highest tier of fines: up to twenty million euros or, for an undertaking, up to 4 % of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5)(a) GDPR).

When to call a lawyer

• when you want to use an employee’s photo in paid advertising, on packaging or in print;
• when the consent is written into the employment contract or the work rules;
• when a former employee demands removal of photos or threatens a lawsuit;
• when you want to keep old posts with photos of employees who have left;
• when event photos also show clients or children.