DPA case 35/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A former employee complained that their old employer used their photo in a recruitment campaign without permission. The Belgian Data Protection Authority found that the employer did not have a valid reason to use the photo. This case serves as a warning for businesses to obtain consent before using personal images.
What happened
The employer published the former employee's photo in a recruitment campaign without their consent.
Who was affected
The former employee whose photo was used in the employer's marketing materials.
What the authority found
The authority concluded that the employer lacked a legal basis for processing the former employee's personal data, including their photo.
Why this matters
This case highlights the importance of obtaining consent for using personal images, especially after an employee has left a company. Businesses should review their practices to ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was a former employee of the controller and worked with them until 2021. In August 2023 the data subject noticed that the controller published her photo in a recruitment campaign on the controller's website and social media. The data subject had never consented to this and was working with one of the controller's competitors at that time. On 31 August 2023, the data subject requested the controller to erase all her images on the website and social media and not use them again in the future. The controller responded that arrangements were being taken regarding the use of people's photos after their departure from the company. Therefore, the controller refused to delete the images, but informed the data subject that new photographs would be made to prevent situations like this. On 6 November 2023 the data subject filed a complaint with the Belgian DPA ("APD"). Firstly, the DPA noted that a person's name, first name and photograph are considered personal data under Article 4(1) GDPR and the publishing of such data is considered to be processing under Article 4(2) GDPR. Secondly, the APD noted that each processing activity should have a legal basis according to Article 5(1)(a) GDPR read together with Article 6(1) GDPR. The DPA examined consent, contract and legitimate interest as possible legal bases. Regarding consent, the DPA stressed that consent seemed impossible because there can be no 'free' consent in the context of an employee-employer relationship according to Article 6(1)(a) GDPR and Article 4(11) GDPR. Regarding contract, the APD stated that to successfully invoke the performance of a contract as a legal basis, the processing needs to be necessary to perform that contract according to Article 6(1)(b) GDPR. Since the data subject's contract had already ended in 2021, the controller could no longer invoke this legal basis. Additionally, the DPA stated that the controller would also not be able to invoke contract as a legal basis during the e
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 35/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 35/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: