Image of a person is one of the types of personal data and is subject to protection under the provisions of the GDPR. Processing of personal data, including images, requires the explicit consent of the person to whom the data relates or another legal basis provided for in the regulations. When processing a person’s image, it is also important to comply with copyright law. Can the processing of an image be based on a contract without the need to obtain separate, explicit consent from the person?
Contract as a legal basis for image processing
Processing of personal data is permissible in particular when it is necessary for the performance of a contract to which the person whose image is concerned is a party, or to take action at the person’s request before entering into a contract (Art. 6(1)(b) GDPR). As for an image, it is not a special category of personal data, and there may be situations in which the processing of an image is necessary for the performance of a contract or to take action before its conclusion, for example, to carry out a photo session, a film recording, or other artistic project.
What to include in an image use contract
The fact of concluding an image use contract determines only the legal basis for processing. It should be remembered that the person entitled to use the image is also subject to other obligations arising from the GDPR. When concluding a contract, special attention should be paid to the way in which personal data, including images, will be processed. The contract should contain precise provisions regarding the purpose and method of data processing, the processing period, as well as the type of data processed and the entities that will have access to the data. It is also necessary to provide the person whose image is concerned with the possibility of exercising their rights, such as the right to information about the processing of their personal data, the right to access their data, or to correct it. This information can be included in both the contract itself and in the form of a separate document in the form of an information clause.
Can consent to image processing be withdrawn?
If the processing of personal data is based on the consent of the person concerned, it can always be withdrawn. Although both signing a form that states “I agree to the use of my image…” and signing a contract for its use have the same real effect, which is to authorize the use of our image by a third party, the GDPR distinguishes between these two legal bases for the processing of personal data. Consent is a unilateral statement that we can withdraw at any time. In the case of a contract, we are bound by the provisions agreed by both parties. Therefore, if the authorization to use the image has been included in the contract, we cannot withdraw it if the contract does not allow it. However, I would like to draw attention to the fact that this applies only to issues related to the processing of personal data.
Consent to the dissemination of an image – copyright law
In the case of consent to the dissemination of an image within the meaning of Art. 81 of the Copyright and Related Rights Act, it is possible to encounter the view that consent to the dissemination of an image can be withdrawn even if the parties’ arrangements were contractual in nature. However, this always depends on the circumstances of the specific case. The question remains about the relationship between these two regulations, i.e., copyright law and the GDPR. As of my knowledge cutoff of September 2021, this issue has not yet been clearly resolved.