Which GDPR legal ground applies when broadcasting recognizable persons?

Which GDPR legal ground does a broadcaster or streaming platform need to publish audiovisual works featuring recognisable natural persons? That was the question examined by the Belgian DPA in its latest decision.

The decision related to a kind of documentary, a “human interest” show/programme. The BDPA’s Litigation Chamber summarised the facts as follows (para. 2 of the decision):

“The complainant works in the public sector. In September 2022, a human interest programme was recorded in this sector by [X2] to be broadcast on television and posted on a streaming platform by [X1]. The complainant agreed to cooperate in the production subject to some conditions. One of these conditions predetermined by the complainant was that he would not be fully portrayed unless his face was made unrecognisable (blurring). This was settled through an agreement (a so-called quitclaim) between the complainant and [X2].

“On the day of the broadcast by [X1], the complainant notes that, contrary to what was agreed, he was in fact recognisable on camera. The complainant then contacted [X2] who explained that this was overlooked in the editing process. The complainant pointed out that other colleagues were indeed made unrecognisable. The episode was removed from the streaming platform and reinstated online after the complainant was made unrecognisable.

In addition to data protection rules, many civil law countries grant “image rights” / the “right of personal portrayal”, which in essence requires (non-GDPR) “consent” for the use of images/footage where a person is recognisable. This does not necessarily require consent as a GDPR legal ground, though (e.g. contract or legitimate interest might work).

Here, the Litigation Chamber said that the use of the “quitclaim” created an assumption that consent was used as a legal ground under the GDPR in the framework of audiovisual productions:

“The Litigation Chamber points out that prima facie the complainant had given permission for the recordings through the quitclaim, without him being in the picture recognisably. The consent given therefore did not relate to the film recordings in which he would be shown recognisably. Since the complainant’s face would have appeared several times in the audiovisual production anyway, this leads the Litigation Chamber to suspect that this constitutes a potential violation of Article 5.1.a) in combination with Article 6.1 GDPR, as there is no valid legal basis applicable for the processing of the personal data, namely image recordings of the complainant’s face.” (para. 11)

The BDPA concludes by issuing a warning to always ensure that there *is* a valid legal ground, but it *does not* specifically require consent.
Put differently: if you can reasonably use another legal ground, that might be OK – but be consistent & comprehensive. Anything beyond might be a GDPR infringement.

Decision (in Dutch): https://lnkd.in/eZsBfJmQ

privacy