We would like to ensure that you are still receiving content that you find useful – please confirm that you would like to continue to receive ILO newsletters.
02 September 2020
The Data Protection Agency recently issued a decision seriously criticising an employer which did not respond adequately after receiving a deletion request from a former employee relating to video content.
Data controllers must, without undue delay, delete the personal data of a data subject if the processing of the data is based on consent and that consent is withdrawn, unless the data controller has another processing basis to support the processing. In this case, the Data Protection Agency had to decide whether an employer had fulfilled its obligations in this regard.
The case involved a former employee of a consulting firm who, during his employment, had given consent for the consulting firm to publish photos and videos of him for use in promotional material on the company's website, leaflets, newsletters and other external material.
During the employee's employment, a number of advertising videos were recorded, which featured the employee in question, and posted on the consulting firm's website and YouTube channel. Following the termination of the employment relationship, the employee asked the consulting firm to remove a video of him from YouTube. The firm confirmed on the same day that it would cut him out of all commercials. Approximately two weeks later, the firm confirmed that he had now been cut out of the YouTube commercial, stating that no further changes to the video material would be made as he had consented to the firm's use of the videos.
When the former employee realised that he continued to appear in the firm's marketing material, he complained to the Data Protection Agency.
Initially, the Data Protection Agency noted that the company had based its processing of the personal data on the employee's consent and that this consent must be considered withdrawn at the request for deletion.
The Data Protection Agency noted that after three months the employee was still appearing in a video on the consulting firm's website and in a video on the company's YouTube channel. Therefore, the agency expressed serious criticism for the consulting firm's failure to fulfil its obligation to delete the videos in which the employee appeared without undue delay.
The decision demonstrates that employers must carefully consider whether a request for deletion constitutes a withdrawal of consent, as any personal data processed on the basis of the consent must be deleted without undue delay, unless the employer (already) has another lawful basis for the processing.
Moreover, the specific situation also illustrates the general weakness of basing processing on consent, since consent is relatively easy for data subjects to withdraw.
However, it is stated in the Data Protection Agency's guidance on data protection in the employment context that the processing of images, including videos, of employees will often be possible only on the basis of consent.
For further information on this topic please contact Søren Terp Kristophersen at Norrbom Vinding by telephone (+43 35 25 3940) or email (firstname.lastname@example.org). The Norrbom Vinding website can be accessed at norrbomvinding.com.
The materials contained on this website are for general information purposes only and are subject to the disclaimer.
ILO is a premium online legal update service for major companies and law firms worldwide. In-house corporate counsel and other users of legal services, as well as law firm partners, qualify for a free subscription.