A data controller must, without undue delay, delete the personal data of a data subject if the processing of the data is based on consent and that consent is withdrawn, unless the data controller has another processing basis to support the processing. In this case, the Data Inspectorate had to decide whether an employer had fulfilled its obligations in this regard.
The case involved a former employee of a consulting firm who, during his employment, had given consent for the consulting firm to publish photos and videos of him for use in promotional material on the company's website, leaflets, newsletters and other external material.
During the course of the employee’s employment, a number of advertising videos were recorded, which included the employee in question, and posted on the consulting firm's website and its YouTube channel. Following the termination of the employment relationship, the employee asked the consulting firm to remove a video of him from YouTube. The firm confirmed the same day that it would cut him out of all commercials. Two weeks later, the firm confirmed that he had now been cut out of the YouTube commercial, stating that no further changes to the video material would be made as he had consented to the firm’s use of the videos.
When the former employee realised that he continued to appear in the firm’s marketing material, he complained to the Data Protection Agency.
An unnecessarily slow deletion process
Initially, the Data Protection Agency noted that the company had based its processing of the personal data on the employee’s consent and that this consent had to be considered withdrawn at the request for deletion.
The Data Protection Agency noted that after three months, the employee was still appearing in a video on the consulting firm’s website as well as in a video on the company’s YouTube channel. The Data Protection Agency therefore expressed serious criticism for the consulting firm’s failure to fulfill its obligation to delete the videos in which the employee appeared, without undue delay.
Norrbom Vinding notes
Firm: Norrbom Vinding