In July 2020 a case was considered by the Danish Data Inspectorate concerning the implications for consent when a data subject exercises the right of erasure.
The right of erasure means that a data controller must, without undue delay, delete the personal data of a data subject if the processing of the data is based on consent and that consent is withdrawn, unless the data controller has another processing basis to support the processing. In this case, the Data Inspectorate had to decide whether an employer had fulfilled its obligations in this regard.
The case involved a former employee of a consulting firm who, during his employment, had given consent for the consulting firm to publish photos and videos of him for use in promotional material on the company’s website, leaflets, newsletters and other external material.
During the course of the employee’s employment, a number of advertising videos were recorded, which included the employee in question, and posted on the consulting firm’s website and its YouTube channel. Following the termination of the employment relationship, the employee asked the consulting firm to remove a video of him from YouTube. The firm confirmed the same day that it would cut him out of all commercials. Two weeks later, the firm confirmed that he had now been cut out of the YouTube commercial, stating that no further changes to the video material would be made as he had consented to the firm’s use of the videos.
When the former employee realised that he continued to appear in the firm’s marketing material, he complained to the Data Protection Agency.
An unnecessarily slow deletion process
Initially, the Data Protection Agency noted that the company had based its processing of the personal data on the employee’s consent and that this consent had to be considered withdrawn at the request for deletion.
The Data Protection Agency noted that after three months, the employee was still appearing in a video on the consulting firm’s website as well as in a video on the company’s YouTube channel. The Data Protection Agency therefore expressed serious criticism for the consulting firm’s failure to fulfill its obligation to delete the videos in which the employee appeared, without undue delay.
Notes from the Norrbom Vinding decision
- The decision shows that employers must carefully consider whether a request for deletion constitutes a withdrawal of consent, as the starting point is that any personal data processed on the basis of the consent must be deleted without undue delay, unless the employer (already) has another lawful basis for the processing.
- The specific situation also illustrates the general weakness of basing processing on consent, since consent is relatively easy for the data subject to withdraw.
- However, it is stated in the Danish Data Protection Agency’s ‘Guidance on data protection in the employment context’ that processing of images, including videos, of employees will often be possible only on the basis of consent.
Mandy P Webster, Data Protection Consultant