Outcomes - Selected Case Summaries
Categories
Employee image in directory does not violate the DPA
Informal Resolution | 22 May 2023
A civil servant was informed that she was required by her government employer to upload her image to the HR administration platform. The data subject objected, believing this violated her data protection rights, and asked the Ombudsman to investigate whether the publication of the image was lawful under the DPA, and whether the image constituted “sensitive personal data”. The data controller clarified that the image would be used in the employee directory, but not, for the time being, in the employee’s Outlook profile, which would be a separate purpose that would be analyzed separately.
We investigated the matter and concluded that the image might potentially reveal some sensitive personal data, but the intended, limited use would not constitute a significant risk. Since the personal data relates to the employee’s work, there is only a limited expectation of privacy, and inclusion of the image in the employee directory is reasonably required. We did recommend that criteria be introduced to identify circumstances when employees could request to opt out. A sheet with FAQs, which was provided to employees upfront, met the requirements of the right to be informed. No further action was required.