What is the legal basis in the case of monthly tickets for an employee? Is consent for the photo necessary?

ANSWER

The factual circumstances and the purposes for which the employee's image is placed on the ticket should be analysed in detail. In this case, the need to include a photo on the tickets may result from the controller's legitimate interest (Article 6(1)(f) GDPR).

Consent will only be necessary if placing the employee's photo on the ticket is not required under applicable law or in connection with the controller's legitimate interest.