GDPR, Facebook and employment
Discussion
For the past three years, until recently, MrsC worked in a self-employed capacity for a dog day care company. Part of the company owner's approach to marketing was to photograph and video the dogs and the people working there, on an almost daily basis, and posting these to social media.
When MrsC left, somewhat acrimoniously, she submitted a formal SAR to have all her personal data removed from their records, including photos and videos. The company were given the requisite 30 days to do so, and responded on day 30 stating that they had complied. However they haven't, and there are still (literally) hundreds of pictures and videos of her on the company's social media pages.
She wrote to them again to give them a further 7 days to comply, which they declined to do and said that the request was not sufficiently specific. The request stated that they should remove all images, still & moving, of her from all of their records and their social media. The fact that there are hundreds of these is of the company's making, not MrsC's, and her image is effectively still being used to promote and market the company. As a further example, they had hundreds of flyers printed in the week after she left with a picture of her being the main image content. These have apparently been dealt with by the application of a sticker over the picture.
Given the intransigence of the company we have done two things:
- contacted the ICO and reported this. The ICO however have responded with something which pretty much states "sorry, not much we can do or help with. Have you tried asking them again?", which is pretty pathetic. I thought GDPR was a fairly hefty stick with which the ICO could beat people?
- contacted Facebook. They asked for proof of ID, which was sent (photographic) and then said they couldn't be sure which images were MrsC so would we mind either PFOing, or had we thought about contacting the ICO regarding a GDPR breach
Any thoughts on what else we can try?
When MrsC left, somewhat acrimoniously, she submitted a formal SAR to have all her personal data removed from their records, including photos and videos. The company were given the requisite 30 days to do so, and responded on day 30 stating that they had complied. However they haven't, and there are still (literally) hundreds of pictures and videos of her on the company's social media pages.
She wrote to them again to give them a further 7 days to comply, which they declined to do and said that the request was not sufficiently specific. The request stated that they should remove all images, still & moving, of her from all of their records and their social media. The fact that there are hundreds of these is of the company's making, not MrsC's, and her image is effectively still being used to promote and market the company. As a further example, they had hundreds of flyers printed in the week after she left with a picture of her being the main image content. These have apparently been dealt with by the application of a sticker over the picture.
Given the intransigence of the company we have done two things:
- contacted the ICO and reported this. The ICO however have responded with something which pretty much states "sorry, not much we can do or help with. Have you tried asking them again?", which is pretty pathetic. I thought GDPR was a fairly hefty stick with which the ICO could beat people?
- contacted Facebook. They asked for proof of ID, which was sent (photographic) and then said they couldn't be sure which images were MrsC so would we mind either PFOing, or had we thought about contacting the ICO regarding a GDPR breach
Any thoughts on what else we can try?
I had it in my last contract that I signed away any rights to photographs taken while I was working or at company events and it gave permission for ongoing social media use even after leaving the company. This was a large company though and I never ended up in a photo but I guess it was there so representing the company in photos was part of the job description and part of the work employees were paid to do while at the company.
Did she have anything similar in her contract?
Did she have anything similar in her contract?
On what legal basis are you requesting this (other than as fallout from leaving acrimoniously)?
GDPR doesn’t prohibit use of data without permission, nor does it necessarily mean that you can retrospectively change history by back-tracking and editing... it gives structure to how data should be used but it is not a blunt hammer allowing you to force companies to do as you wish...
Use of a photo for marketing material produced at a time when she was an employee is probably legitimate and her leaving is unlikely to change that, similarly, historical social media is just that - a historical record of a moment in time...
If you have a specific legal challenge then the ICO would probably support you, their lack of support suggests a certain general and vague approach... having said that, in reality there is little resource or energy for the ICO to get involved in this type of case - their interest primarily lies in larger companies and data loss etc.
GDPR doesn’t prohibit use of data without permission, nor does it necessarily mean that you can retrospectively change history by back-tracking and editing... it gives structure to how data should be used but it is not a blunt hammer allowing you to force companies to do as you wish...
Use of a photo for marketing material produced at a time when she was an employee is probably legitimate and her leaving is unlikely to change that, similarly, historical social media is just that - a historical record of a moment in time...
If you have a specific legal challenge then the ICO would probably support you, their lack of support suggests a certain general and vague approach... having said that, in reality there is little resource or energy for the ICO to get involved in this type of case - their interest primarily lies in larger companies and data loss etc.
OK, thanks, that clarifies somewhat.
There was never any consent given, written or verbal, to the use of the images, unless a failure to decline is tacit agreement?
The reason for the removal is principally because MrsC doesn't want her image used to promote the company, which is what's currently happening. I get that the ICO aren't really after this level of issue, although I would have thought that they would at least send a warning shot to the company to tell them to comply?
I was under the impression that under GDPR you can request that a company stop processing your data, and using it to promote the company would be classed as "processing"? But if that's not the case then is there anything else that can be done?
There's no legal aspect to this. It's simply a wish to cut any and every tie with the company and not to be a part of furthering their business, which is increasingly run on falsehoods (for example, "all of our staff are DBS checked" when in fact not one, of around 12, is) and questionable ethics (almost zero compliance with the new 2018 regulations) etc etc. DBS are, quite unbelievably, apparently powerless to stop them making that claim/statement, although apparently the local council have visited them regarding the regs.
There was never any consent given, written or verbal, to the use of the images, unless a failure to decline is tacit agreement?
The reason for the removal is principally because MrsC doesn't want her image used to promote the company, which is what's currently happening. I get that the ICO aren't really after this level of issue, although I would have thought that they would at least send a warning shot to the company to tell them to comply?
I was under the impression that under GDPR you can request that a company stop processing your data, and using it to promote the company would be classed as "processing"? But if that's not the case then is there anything else that can be done?
There's no legal aspect to this. It's simply a wish to cut any and every tie with the company and not to be a part of furthering their business, which is increasingly run on falsehoods (for example, "all of our staff are DBS checked" when in fact not one, of around 12, is) and questionable ethics (almost zero compliance with the new 2018 regulations) etc etc. DBS are, quite unbelievably, apparently powerless to stop them making that claim/statement, although apparently the local council have visited them regarding the regs.
As I understand it, and happy to be corrected here, but “an image” or “several images” on their own aren’t actually “personal information/data” as from the image(s) no one would be able to say “ohhh look that’s Mrs AN Other, from 21 Arcadia Avenue, anytown.
Therefore, I don’t think GDPR come in to effect but rather Privacy Laws may.
As for false advertising; Trading Standards.
Therefore, I don’t think GDPR come in to effect but rather Privacy Laws may.
As for false advertising; Trading Standards.
Unfortunately, the ICO can't do much.
in a similar vein, we had a new guy start (self employed) he asked for the old company to remove his data, remove his address from google as their place of business and from their website.
They ignored him for a few months and the ICO wrote to them stating they need to comply and reply to the ICO with why it wasn't removed.
They removed the data but didn't reply to the ICO. ICO followed this up thanking them for the compliance but demanded a written apology within 7 days to our new guy. It didn't happen.
Our guy is now taking them to small claims court over other issues but has included the ICO complaint in the small claims
in a similar vein, we had a new guy start (self employed) he asked for the old company to remove his data, remove his address from google as their place of business and from their website.
They ignored him for a few months and the ICO wrote to them stating they need to comply and reply to the ICO with why it wasn't removed.
They removed the data but didn't reply to the ICO. ICO followed this up thanking them for the compliance but demanded a written apology within 7 days to our new guy. It didn't happen.
Our guy is now taking them to small claims court over other issues but has included the ICO complaint in the small claims
Marcellus said:
As I understand it, and happy to be corrected here, but “an image” or “several images” on their own aren’t actually “personal information/data” as from the image(s) no one would be able to say “ohhh look that’s Mrs AN Other, from 21 Arcadia Avenue, anytown.
This...but on a totally different tack - any business using an image with a clearly definable image of an individual to promote their business (i.e. for commercial purposes) requires a model release from that individual - in absence of that, you can require them to stop using images for that purpose...
contractual agreement to have photos used would count - otherwise, a specific release for the use of the photos would be needed... this doesn't cover news where basically the photographed person has virtually zero rights (or your rights are simply as big as the lawyers bill you can afford)... also won't cover social media necessarily - if that is 'reportage' which is news - but would do if it were specifically advertising / promoting the company... also doesn't cover incidental appearances in photos - only if a major / discernable person such that they could be seen as an advocate of / promoting the company...
can't remember specific legislation off-hand, but well known to any professional photographers...
CAPP0 said:
edthefed said:
Maybe a bit left field...write to the compant again telling them that if the images are not removed by a certain date and continue to be used without consent you will require payment per image per day.....
Nice thought, not sure whether it has legs!if they were not then simply tell them to remove them as they have no model release - the detail is in the contract of employment
Examine the contract.
If there's no mention of it you have some grounds for complaint.
Complain.
Despite everything, the measures are 'personally identifiable' data' .. I would say a picture or video could be classed as that; it doesn't need to end in a place of habitation.
You could of course follow said company on social media etc with a follow up video (from the same person) of what you think of their efforts. They would stop pretty sharply if you kept it factual.
If there's no mention of it you have some grounds for complaint.
Complain.
Despite everything, the measures are 'personally identifiable' data' .. I would say a picture or video could be classed as that; it doesn't need to end in a place of habitation.
You could of course follow said company on social media etc with a follow up video (from the same person) of what you think of their efforts. They would stop pretty sharply if you kept it factual.
- sausages_in_lawn
akirk said:
Marcellus said:
As I understand it, and happy to be corrected here, but “an image” or “several images” on their own aren’t actually “personal information/data” as from the image(s) no one would be able to say “ohhh look that’s Mrs AN Other, from 21 Arcadia Avenue, anytown.
This...but on a totally different tack - any business using an image with a clearly definable image of an individual to promote their business (i.e. for commercial purposes) requires a model release from that individual - in absence of that, you can require them to stop using images for that purpose...
contractual agreement to have photos used would count - otherwise, a specific release for the use of the photos would be needed... this doesn't cover news where basically the photographed person has virtually zero rights (or your rights are simply as big as the lawyers bill you can afford)... also won't cover social media necessarily - if that is 'reportage' which is news - but would do if it were specifically advertising / promoting the company... also doesn't cover incidental appearances in photos - only if a major / discernable person such that they could be seen as an advocate of / promoting the company...
can't remember specific legislation off-hand, but well known to any professional photographers...
k you are talking about. Clearly you’ve got zero clue here. George Smiley said:
akirk said:
Marcellus said:
As I understand it, and happy to be corrected here, but “an image” or “several images” on their own aren’t actually “personal information/data” as from the image(s) no one would be able to say “ohhh look that’s Mrs AN Other, from 21 Arcadia Avenue, anytown.
This...but on a totally different tack - any business using an image with a clearly definable image of an individual to promote their business (i.e. for commercial purposes) requires a model release from that individual - in absence of that, you can require them to stop using images for that purpose...
contractual agreement to have photos used would count - otherwise, a specific release for the use of the photos would be needed... this doesn't cover news where basically the photographed person has virtually zero rights (or your rights are simply as big as the lawyers bill you can afford)... also won't cover social media necessarily - if that is 'reportage' which is news - but would do if it were specifically advertising / promoting the company... also doesn't cover incidental appearances in photos - only if a major / discernable person such that they could be seen as an advocate of / promoting the company...
can't remember specific legislation off-hand, but well known to any professional photographers...
k you are talking about. Clearly you’ve got zero clue here. 
Okay - if you want to be fussy then technically and legally a company can use any photo of any person to advertise something - however, the minute there is any suggestion that it defames / implies something about that person that is not accurate then they can’t- so any business with any common sense would only use a photo with a model release - it only takes the subject of a photo to state that it suggests something about them that is not true for the company to get into trouble...
The OP’s other half complaining that the images represent her as supporting the organisation when she doesn’t is sufficient to cause issues - you possibly have issues challenging historical images especially as she worked there and so could be considered to support them but ongoing use when an acrimonious leave took place suggests she no longer supports them and that is enough to cause an issue
Yes it would be a civil case but easy enough to win, and anyone who therefore suggests that an organisation doesn’t need a model release for commercial use of someone’s image is a fool and causing all sorts of issues...
Equally in this situation it would be a sensible approach to the organisation on a non-confrontational basis to ask them not to use the images for that reason...
Of course if you know reasons for an approach directly opposite to that taken by every commercial photographer and opposite to the recommendations by everyone else involved in this world then do feel free to share your pearls of wisdom other than just wanting to rant in an unhelpful manner
Check the employment contract. Then go from there. If she had signed that to work there and it contains details about the use of on premises photography to promote the business then they are well within their rights. As I understand it photographs are Personal Data not PII so are governed slightly differently by the EU and the GDPR. Worth having a read online on some reputable sites to understand more.
If I can be frank, is she seriously concerned about her welfare and the photos being online, or is it more of a case of 'stuff you lot I am angry at leaving and want to cause a ruckus to stick it up them' - it could take a lot of time and effort to sort this out, maybe its worth drawing a line under it and moving on with her life?
If I can be frank, is she seriously concerned about her welfare and the photos being online, or is it more of a case of 'stuff you lot I am angry at leaving and want to cause a ruckus to stick it up them' - it could take a lot of time and effort to sort this out, maybe its worth drawing a line under it and moving on with her life?
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff