The use of images depicting people is a particularly sensitive matter from the perspective of privacy and data protection regulations.
As a rule, an image of a person constitutes ‘personal data’, and this requires that its processing be carried out in compliance with the current regulatory framework on data protection, centred on Regulation (EU) 2016/679 and, in Italy, the Personal Data Protection Code (Legislative Decree No. 196/2003).
In the specific field of digital marketing, the use of such images is widespread. Despite this, there are often misconceptions regarding privacy issues, which should be clarified to limit the risks arising from these activities.
First and foremost, an image of a person is ‘personal data’ in its own right, that is to say, regardless of whether further information about the person depicted is available. An image, for example, must be considered personal data even if the entity processing it has no way of knowing the name of the person depicted.
Furthermore, the protection afforded by the law does not cease simply because images are published online or in other contexts, thereby making the content accessible to anyone. In this regard, data protection regulations must also be complied with when downloading images available on the internet. This applies, in particular, even where images are simply downloaded and then stored internally for possible future use, given that, under the law, mere storage still constitutes ‘processing’ of personal data.
Furthermore, it is worth clarifying that the legislation applies not only to digital images but also to analogue photographs, provided these are stored in an archive that makes them retrievable according to specific criteria.
Finally, a situation that is often misunderstood concerns the posting of content on social media by individuals acting on the instructions of a company. Consider, for example, students at a language school who post photos of the school’s open day on Instagram, following a specific initiative by the school, which in return has promised a discount on course fees. Well, even though privacy legislation does not apply when personal data is processed for purely private purposes, in such cases the activity, as it is carried out at the behest of a commercial operator, could be considered fully subject to legal obligations. These obligations, in particular, would primarily bind the operator itself, which would bear the main responsibilities relating to the dissemination of images by individuals.
Articoli Correlati