Use of an individual’s image in the media: A question of consent
A person’s image, in the sense of a physical picture of an individual, is subject to protection as a personality right and as personal data. The rule under Art. 81 of the Polish Copyright Act is that a person whose image is fixed must consent to dissemination of the image. Fixation of an image includes capturing of the whole or part of a person’s profile, through any means—photo, film, drawing, painting, or portrait—enabling identification of the person. Dissemination of an image means any form of publication, i.e. making it accessible to an unlimited set of recipients, as in the case of media access. It is irrelevant whether use of the image is aimed at generating financial gain.
The regulations provide for a fixed catalogue of exceptions where it is not necessary to obtain consent to dissemination of a person’s image. The first is a situation where a fee was paid for posing. The second is dissemination of the image of a well-known person, where the image is made in connection with the subject’s performance of a public function. The third exception is dissemination of a person’s image constituting only a detail in a greater whole such as an assembly, landscape, or public event.
Determining whether there is a legal basis for processing the image under personal data protection regulations is a separate issue.
Consent to dissemination of image under Copyright Law
To disseminate someone else’s image in the media, it is usually necessary to obtain consent. Such consent will be required for example when an employer wants to post photos or videos of staff on Facebook or other social media, in order to promote the employer’s business. Consent will also be required for example when individuals place photos on their social media profiles from conferences they participated in, where other individuals (not a crowd) are visible in the images.
Such consent may be provided in any form, i.e. orally, in writing, expressly or implicitly. According to the courts, granting of consent is not presumed. This means that the fact that consent was granted must not raise doubts. The scope of the consent, i.e. the context, manner, place or frequency of dissemination of the image, must also be easily determined. It is recognised that the scope of consent as to possible manners of use of an image is strictly tied to the awareness of the person whose image is being used. For example, if a person consents to dissemination of their image in any manner or in any context, such consent may be regarded as invalid insofar as the person granting the consent did not realise what they were really agreeing to. The existence of consent to a given use may also be undermined if in light of the context in which the image is presented, e.g. in connection with added text, illustrations, or images of other people, the person’s dignity or privacy is infringed.
To avoid the risk of litigation related to the specific use of a person’s image, it is desirable to specify the circumstances in which the image will be presented (e.g. alongside text or images of others), the place and frequency of publication, as well as the purpose for dissemination of the image (e.g. advertising or promotion). This is indicated particularly when the image will appear regularly or be displayed permanently.
There is also a prevailing view that consent to dissemination of one’s image may be withdrawn. The person granting consent may always withdraw consent before the image is disseminated. But withdrawal of consent does not apply to dissemination occurring prior to withdrawal of consent and not exceeding the scope of the consent. Withdrawal of consent applies to actions that were to occur in the future. This means that dissemination of the image prior to withdrawal of consent is lawful. However, dissemination of an image after withdrawal of consent will be unlawful, e.g. on a website or in social media in the days following withdrawal of consent.
There is no uniform view on whether the subject may waive the right to withdraw consent to dissemination of an image or promise not to withdraw consent for a certain time. The dominant view is that this right cannot be waived. In commercial practice, however, undertakings not to exercise the right to withdraw consent are often encountered. As a rule, merely making such an undertaking does not exclude the right to terminate it. However, if a person has obtained consent to dissemination of an image and then suffers a loss as a result of withdrawal of consent, that person may pursue damages. In particular, it cannot be excluded that refund of a portion of the fee paid for granting consent to dissemination of an image may be sought.
Payment for consent under Copyright Law and fee for posing
Consent for dissemination of an image may be given with or without payment. But paying for consent should not be confused with payment of a fee for posing.
If a person (typically a model) poses for a fee for the purpose of recording his or her image, it is not necessary to obtain the subject’s separate consent to dissemination of their image. Then the existence of consent to multiple dissemination of the image, at any time and in any territory, is presumed. If the model does not agree to a certain use of his or her image, this reservation should be made immediately. However, the absence of such a reservation does not deprive the model of the ability to seek protection against dissemination of their image in a context that infringes their dignity or honour. Regardless of receiving payment, a model may always oppose such dissemination of their image. In that case, payment of a fee for posing does not exclude the unlawfulness of such use of their image.
Payment of a fee for posing is thus an exception from the obligation to obtain consent to dissemination of an image. As a rule, it is also not necessary to specify the circumstances in which the image may be disseminated. Nonetheless, defining the boundary between a situation of paid posing and granting consent to dissemination of an image may present difficulties. For this reason, to avoid doubts, it is worthwhile specifying in a modelling contract, as in an agreement consenting to dissemination of an image, the context and manner of dissemination of the image.
Consent to processing of image under GDPR
Given the broad definition of personal data and processing of personal data, there is no doubt that dissemination of a person’s image in the media should be regarded as processing of personal data within the meaning of the EU’s General Data Protection Regulation (2016/679).
It should first be pointed out that not every image will fall within a specially protected category of personal data under Art. 9 GDPR. Specially protected data may be processed only in strictly defined instances. A facial image constitutes specially protected biometric data only if it is processed in a special technical manner.
The mere publication of an image in the media, e.g. on social media, will generally not fall within this special method of processing. Thus only the situation of processing of “ordinary” personal data arises, meaning that all the basic rules under the GDPR will apply to processing of the image. This firstly means the requirement for the lawfulness of the processing, i.e. having a legal basis for processing the personal data for a specific purpose. In most instances of processing of an image in the media, this will be the consent of the person whose image is used. But cases where an image is processed on some other basis under Art. 6(1) GDPR should not be ruled out, for example for the purpose of legitimate interests when the person whose image is processed has received a fee for this purpose. It is thus crucial to determine the legal basis for the processing, and then, if the processing is conducted on the basis of the subject’s consent, to ensure that the consent meets the conditions sets forth in Art. 7 GDPR.
This means that a request for consent for purposes of the GDPR must be clearly distinguished from other issues, such as requesting consent pursuant to the Copyright Law. Moreover, a request for consent for GDPR purposes must be presented in an understandable and easily accessible form, in clear and simple language. Consent must also be voluntary, and thus it is impermissible, for example, to use default ticking of checkboxes with request for consent, deeming consent to be given when the subject whose image is to be used did not actually tick the boxes.
Significantly, the request for consent for GDPR purposes should identify at least the controller of the personal data in the form of the image and the purposes for processing the image.
If the request does not meet these conditions, the statement by the subject whose image is to be used is not binding and does not constitute a basis for processing of personal data under the GDPR. In such case, processing of data in the form of the image may be held to be unlawful and result in imposition of sanctions on the entity using the image.
It is also important that consent may be withdrawn at any time by the person who has given it, and withdrawing consent must be just as easy as giving consent. Processing made before withdrawal of consent will remain lawful. However, it is vital to cease processing the image immediately after consent is withdrawn. To this end, it is necessary to implement technical and organisational measures in the data controller’s organisation ensuring that processing of personal data is halted in such situations. Processing of data after withdrawal of consent, particularly in the media, creates a risk that the data subject will file a complaint with the president of the Personal Data Protection Office, which may in turn lead to an inspection of the data controller by the regulator.
Significantly, the Court of Justice of the European Union has held that recording and subsequently posting online falls within the concept of processing of personal data (C-345/17 Buivids, judgment of 14 February 2019). For purposes of the GDPR, it is irrelevant who was recorded, for example if it was a policeman recorded performing his official duties—such use of an image should also be treated as processing of personal data.
Summary
Today access to the media has a fundamentally different meaning that it had a couple of decades ago. We are no longer just passive viewers or readers, but we jointly contribute to the media by uploading photos or videos. If we post material showing another identifiable person, who is not a public figure or just a face in the crowd, we must obtain consent to dissemination and processing of the person’s image. Lack of consent may lead to liability for infringing personality rights or the GDPR. Significantly, the rights to one’s image cannot be waived, and thus it is not possible to obtain consent to practically eternal exploitation of another person’s image and in every conceivable context. It does appear permissible to temporarily agree not to exercise this right, i.e. not to withdraw consent granted for use of one’s image. But in that situation as well, it is still essential to define as precisely as possible the manner and context of use of the image, to avoid overstepping the bounds of the consent.
Katarzyna Pikora, attorney-at-law, Intellectual Property practice, Wardyński & Partners
Katarzyna Szczudlik, adwokat, New Technologies practice, Wardyński & Partners
