The CNPD has published its guidelines on the right to one’s image

The purpose of this document is to clarify the general conditions for exercising one’s image rights and the protection of the image as personal data.

The Luxembourg supervisory authority answered the following questions:

• What to watch out for when taking pictures?
• What precautions should be taken when posting photos?

The CNPD confirmed that the image of a person is “personal data” within the meaning of the GDPR if the person is “identified or identifiable by specific elements related to his physical or physiological identity“. The shooting and publication of photos of identifiable natural persons may constitute processing of personal data falling under the scope of the GDPR.

In this context, it distinguished between the right to one’s image and data protection, since they are subject to distinct legal regimes, in particular to different conditions of exercise.

“Thus, if, in terms of one’s image rights, tacit consent is allowed for the capture of the image, this is not the case for the protection of personal data (..).

Data processing may also be based on other conditions of lawfulness (e.g. public interest, performance of a contract)“.

Moreover, as soon as the processing of the data falls under the scope of the GDPR, it is imperative to respect the rights of the persons concerned. This concerns the right to information, the right of access, the right of rectification, the right to erasure, the right to object and the right to restriction, as well as, where appropriate, the right to challenge a decision made based on an automated process, and the right to data portability.