Can I demand that my former employer stop processing my image after the employment relationship ends?

ANSWER

The employer is entitled and obliged to process the employee's personal data as specified in Article 22{1} of the Labour Code. The employer processes such personal data on the basis of Article 6(1)(c) GDPR (no employee consent is required). After the employment relationship ends, the employer is also obliged to retain the employee's personnel file for 10 years (and thus all personal data contained therein). The above does not, however, apply to the employee's image. Photos of the employee – whether on a website, in employee chronicles, or from other situations in which they were taken – may be processed by the employer on the basis of the employee's consent given under Article 6(1)(a) GDPR.

If, after the employment relationship ends, the employee no longer consents to the former employer processing their personal data in the form of their image, they should first withdraw the consent to processing (Article 7(3) GDPR), and then submit a request for erasure of data (Article 17 GDPR). Upon receipt of the above requests, the employer is obliged to process the request within 30 days pursuant to Article 12(3) GDPR. A link to request templates that may be used is enclosed: https://wtb.org.pl/wzory-pism