On 20 February 2024 (Decision 35/2024) the Belgian Data Protection Authority (DPA) ruled on a complaint about an ex-employer's use of photographs of a former employee on the company's website and social media accounts in a campaign to recruit new colleagues. The former employee had requested to erase the data after she left the organization while she was working for a competing company which the employer refused based on the provisions of its work rules. The employee never consented to the use of her pictures on public media.

Firstly, it is important to recall that contact details of a natural person, such as name, first name and photos are considered personal data.

The publication of such data on a website and/or social media accounts constitutes processing of personal data. Therefore, (former) employers should be aware that such processing must rely on one of the legal bases in the GDPR. The DPA rightfully points out that the company work rules (“arbeidsreglement”/”règlement de travail”) are not a valid legal basis to process personal data.

The DPA confirms that the employer can not rely on the execution of the employment contract if the employee is no longer employed as there is no longer a contract. Moreover, the necessity requirement could not be met as the publication of the photographs on the website or on social media to attract new colleagues was not necessary to execute the employment contract.

Legitimate interest can not be considered as a valid legal base either. According to the DPA it is not necessary to publish photographs of (former) employees to attract new employees. Additionally, the DPA ruled that former employees will not have a reasonable exception that their photographs will be used for this purpose.

Strangely, the DPA mentioned that the processing of photographs could not be based on consent as there cannot be free consent in the context of an employee-employer relationship. However, in the past the DPA has explicitly recognized consent as a valid legal base to process photographs of employees provided the consent is free and the refusal of consent can not lead to any disadvantage for the employee. This ruling should therefore be read in the specific context of this case.

With this decision the DPA confirms its position that employers should immediately delete any photographs or images on public websites or social media accounts upon departure of the employee within the organization, at least after a request for erasure.  

Don’t hesitate to contact our team of specialize lawyers should you have any question regarding this matter!