Katarzyna Szczudlik | In Principle

Designing marketing initiatives in an organisation so they comply with the regulations, including data protection rules, can be problematic. The situation becomes even more complicated if marketing for several companies within a group is carried out by one of the companies, designated through informal internal arrangements (often without concluding any contracts).

Cookies and similar technologies are commonly used marketing tools enabling optimisation of marketing campaigns and more effective targeting of customers. So it comes as no surprise that it’s hard to find a website without a popup window informing users that the site uses cookies, referring the user to the privacy policy and cookies policy for more information. Interestingly, a great majority of these messages are themselves inconsistent with the applicable regulations on data protection, telecommunications, and electronic services.

A person’s image, in the sense of a physical picture of an individual, is subject to protection as a personality right and as personal data. The rule under Art. 81 of the Polish Copyright Act is that a person whose image is fixed must consent to dissemination of the image. Fixation of an image includes capturing of the whole or part of a person’s profile, through any means—photo, film, drawing, painting, or portrait—enabling identification of the person. Dissemination of an image means any form of publication, i.e. making it accessible to an unlimited set of recipients, as in the case of media access. It is irrelevant whether use of the image is aimed at generating financial gain.