In short
Under the EU's GDPR, consent is defined in Article 4(11) and is one of several legal bases for processing personal data (Article 6(1)(a)). Under Article 7, whoever relies on consent must be able to show it was given, and people can withdraw it at any time, as easily as they gave it. In Germany, photos have an extra rule: under § 22 of the Art Copyright Act (KUG), pictures of a person may generally only be distributed or shown publicly with their consent, with exceptions set out in § 23 KUG.
This entry is general information, not legal advice.
Photo: Karthik Balakrishnan / Unsplash
Example
After the company party, a few group shots are meant to go on the company website. Rather than a quick "everyone OK with this?" across the room, show the people in each photo which picture it is and where it will appear, and keep a record of their yes.
What to watch out for
- Specific, not blanket: which photo, for what, and where?
- Freely given means no pressure. Nobody should feel pushed into saying yes.
- Take withdrawal seriously. Under Article 7(3), processing before the withdrawal stays lawful, but from then on consent no longer covers it.
