Page 1

The General Data Protection Regulation

Image rights

Page 2

Content
Introduction ................................................. .................................................. .................... 2
1. Image rights and their relation to the protection of personal data. 3
1.1. The non-application of the GDPR to strictly personal or domestic activities
.................................................. .................................................. .................................. 3
1.2. The application of the GDPR to associative and professional activities ..................... 4
2. Consent in matters of image rights ...................................... ....................... 5
2.1. Consent to the shooting ........................................... ............................... 5
2.2. Consent to publication ............................................. ............................... 6
3. The treatment of an image as personal data ........................... 9
4. Legislation ............................................... .................................................. ................ 11

1

Page 3

Introduction
Image rights and image protection as personal data
raise two main questions:
- What should you watch out for when taking pictures?
- What precautions should be taken when posting photos?
The answers must be formulated on a case-by-case basis: in fact, they differ according to the
quality of the person taking the photo (a private or a professional), the context of the
view (a public event or a private event), of the shooting situation
(a photo posed individually or in a group, a targeted photo or a non-targeted photo)
as well as the destination of the photo (strictly private use, publication
for commercial purposes, an informational publication).
Therefore, these guidelines are not intended to provide answers to
all imaginable hypotheses, but simply intend to clarify the conditions
general rules for the exercise of image rights and the protection of the image as a given
personal character. This document does not address issues related to photos of objects.
protected by rights arising from intellectual property, for example arising from
copyrights attached to a building or a work.
The indications appearing in this document apply whatever the technical means.
used (camera, mobile phone, drone, webcam, etc.) and can also be
transposed to video recordings.

2

Page 4

1. Image rights and their relationship with data protection
personal
In the Luxembourg legal order, the "right to the image" derives mainly from the
case law relating to the “right to private life” as defined in Article 8 of the Convention
European Commission on Human Rights (ECHR) and in the law of 11 August 1982 on the
privacy protection . As a jurisprudential creation, the right to the image is inspired by
also provisions of the amended law of 8 June 2004 on freedom of expression in
media and the amended law of April 18, 2001 on copyright as well as the legislation
regarding the protection of personal data. Jurisprudence
Luxembourg specifies that “image rights can only be implemented if the person
is recognizable ” 1 .
Image rights must be respected by individuals, professionals and stakeholders
institutional. The entry into application of Regulation (EU) 2016/679 of the European Parliament and
of the Council of April 27, 2016 on the protection of individuals with regard to
processing of personal data and the free movement of such data, and
repealing Directive 95/46 / EC (General Data Protection Regulation, GDPR) does not
not modify the legislation and jurisprudence in matters of image rights.
The image of a person is nevertheless a "personal data" within the meaning of
RGPD when the person is "identified or identifiable" by "elements
specific to their physical [or] physiological identity ” . The shooting and the
publication of photos of identifiable natural persons may constitute processing
of personal data falling under the scope of the GDPR.

1.1. The non-application of the GDPR to activities strictly
personal or domestic
The GDPR does not apply to “processing of personal data carried out […]
by a natural person as part of a strictly personal activity or
domestic " 2 . Recital 18 of the GDPR specifies that “personal activities or
household could include […] the use of social networks and online activities that
take place within the framework of these activities ” 3 .
By way of illustration, photos taken during a private party with friends or family and
published in a private album are a strictly personal activity. A publication

1 See

in particular Luxembourg District Court, 9 January 2013, 8/2013, n ° 144831 of the roll (case
“Baby Info” ); Court of Appeal, summary, July 10, 2013, n ° 39634 of the roll.
2 The CJEU had determined that the implementation of video surveillance partially covering the public highway
was not a strictly domestic activity within the meaning of Directive 95/46 / EC: CJEU, František Ryneš c.
Úřad pro ochranu osobních údajů (Office for the protection of personal data) , reference for a preliminary ruling,
judgment of 11 December 2014, C-212/13. Cécile de Terwangne, case law note, RDTI n ° 58, March 2015,
pp. 39-51.
3 However, the use of a social network for professional reasons makes the GDPR applicable: CJEU,
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein c. Wirtschaftsakademie Schleswig-Holstein
GmbH , preliminary ruling, judgment of 5 June 2018, C-210/16. Likewise, the social network itself is subject to the
GDPR.

3

Page 5

photos online by a private person, for example on a social network or a
content hosting platform, does not generally fall within the scope
GDPR application 4 .
Nevertheless, everyone must respect the right to respect for the private life of others, including
image rights. In particular, the person posting the photo must in principle obtain the
consent of identifiable persons before any publication.

1.2. The application of the GDPR to associative activities and
professional
The GDPR not only applies to the processing of personal data
carried out by legal persons but also to data processing carried out
by natural persons in the course of their professional activities. GDPR
also applies "to data controllers or processors who provide
the means of processing personal data for [personal] activities or
domestic " , for example providers of a social network or a photographer.
For example, a professional photographer who is hired by individuals to
taking photos at a private event, such as a wedding, should comply with the
GDPR.
As soon as an online publication is made in the context of a voluntary activity,
for example on behalf of an association, the GDPR must be taken into account by
the association and by the private person acting on behalf of the association 5 .

4 Article

29 Working Party, Opinion 5/2009 on online social networks , 12 June 2009, WP 163, p. 6; Group
de travail "article 29", Statement of the Working Party on current discussions regarding the data protection reform
package, Annex 2 Proposals for Amendments regarding exemption for personal or household activities , February 27
2013, p. 4. In certain cases, the activity of a private person may exceed the strictly
personal or domestic and no longer falls within the exception provided for this purpose. Elements to take into account
consideration are the large number of unknown contacts, the link between the person posting the photo
(or more generally personal data) with the data subject, the frequency and scale of
publication, collaboration with others in connection with the publication and the potential impact on privacy
of others. However, this question goes beyond the question of image rights dealt with in this document.
5 See in particular CJEU, Bodil Lindqvist v. Åklagarkammaren i Jönköping (Lindqvist judgment) , judgment (preliminary ruling),
November 6, 2003, C-101/01, CJEU, Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy and Satamedia Oy (stop
Satamedia) , Judgment (preliminary ruling) [GC], 16 December 2008, C-73/07. Article 29 Working Party, Opinion
5/2009 on online social networks , 12 June 2009, WP 163, p. 6.

4

Page 6

2. Consent in matters of image rights
It is settled case-law that " every person has his image and the use which of it
is made an exclusive right and may oppose unauthorized distribution by it ” 6 . So he has
been judged that " the right of man to his private image is total and that everyone can oppose
to the publication of his features without authorization ” 7 .
The case law in this area holds that a person who gives his consent for the
taking photos does not necessarily give it for publication or broadcast . So there is
place to collect a double consent.

2.1. Consent to the shooting
Article 2 of the law of August 11, 1982 on the protection of privacy sanctions
the "invasion of privacy of private life" , including the fact to fix the image of a person "without
consent ” in a “ place not accessible to the public ” (that is to say a place
strictly private). This article specifies however that, when the shooting is accomplished
“In the sight and knowledge” of the participants of a meeting, “their consent is
presumed ” . Thus, when the subject of the photo is aware of the shooting, the consent
is implied and can be assumed by the person taking the photo. The subject of the photo
however has the right to oppose the shooting.
For example, striking a pose or knowing that photos are being taken
in general constitutes valid consent to the shooting.
The case law of the European Court of Human Rights (ECtHR) has established that the
simple capture of an image, without publication, may constitute an infringement of image rights
when consent is absent 8 .
At public events (for example concerts, sporting events, shows
cultural events, Christmas markets, etc.), the consent of those present can be presumed
when the picture is taken, in particular if the general conditions of the event so specify.
The information of people present at an event can be done through
a referral to a website, by information appearing on the invitation or on the entry ticket
or else by an appropriate display on site.
Case law differentiates between targeted photos and non-targeted photos. Photos
targeted are those in which a person is the main subject, appearing alone, in
being brought to the fore or taking a pose (even in a group). Non- photos
targeted reflect the general mood without having one or more people as the subject
main. Consent (even tacit) is required for targeted photos. In general,
6 Referee

Judge of Luxembourg, Vallone c. Media Press International , Referral of November 20, 1978, Pasicrisie

volume 25, p. 358; Luxembourg District Court, Pierret c. Wegner and Luxembourg Weekly Review
s.à.rl , judgment of June 2, 1976, Pasicrisie tome 23, p. 553.
7 Trib. Arr., March 29, 1995, No. 15758 of the roll.
8 CourEDH , Reklos and Davourlis v. Greece , January 15, 2009, 1234/05, § 40.

5

Page 7

taking a pose, individually or in a group, can be considered a
tacit consent to the shooting. For non-targeted photos, it is usually sufficient
to inform the people concerned.
For minors, consent must be obtained from legal representatives. According to
Belgian and French case law, when the minor has reached "the age of discernment" (at
assess on a case-by-case basis, but in principle from the age of 13), it is recommended to collect the
consent of the minor, in addition to that of his legal representative (double
consent) 9 .

2.2. Consent to publication
2.2.1. The principle of explicit consent
In principle, consent, distinct from consent to the shooting, is necessary for
publish a snapshot of an identifiable person. Case law has already
repeatedly sanctioned the unauthorized reproduction and distribution of images and
movies 10 .
The use of social networks for the distribution of photos is generally to be considered
as a publication and therefore in principle requires the consent of the person
identifiable.
Case law establishes that the burden of proof relating to consent lies with the
which publishes the image and specifies that such authorization " does not necessarily have to result
written, but may be implied, or even presumed, provided that it is certain and
specific ” 11 . Consent can thus be proved by any means, and is not
necessarily fixed in writing. Failure to respond to a request for consent to
publication is in principle equivalent to refusal of consent.
In order to avoid any " legal uncertainty ", the National Commission for the Protection of
data recommends, as far as possible and depending on the context (school,
associative, professional, ...), to ask for a document which allows to provide the consent
separately for each mode of publication concerned, coupled, where appropriate, to a duration
publication and who informs the data subject of the purpose of the publication 12 .
For example, in schools, associations, sports or professionals, students, members,
affiliates or employees could be asked to sign a form once a year to
record consent. It must be possible for this consent to be freely given.
The specific nature of this consent means that the consent is not freely
transferable from one mode of publication to another: for example, the authorization of publication

9 See

also CNPD, Practical sheet on the use of photos or videos in schools .
10 See Trib. Arr. Lux., March 17, 2011, n ° 1014/2011 and Trib. Arr. Lux., April 5, 2011, n ° 123 8/2011.
11 Trib. Arr., March 26, 1987, No. 33260.
12 See in particular CNPD, Practical sheet on the use of photos or videos in schools.

6

Page 8

of a snapshot in a printed newspaper does not include consent to publication on a site
online. In some cases, a contract may also specify the terms of use
of a person's image.
By way of illustration, a client of a photographer can consent explicitly and freely, in
margin of a main contract, to the use of its photos for marketing purposes on a medium
determined (for example a website).
As explained above, consent must be obtained from legal representatives
minors. Specific protections exist regarding the publication of photos of
minors 13 .
Please note that consent can be withdrawn at any time. Consent remains
valid until the moment of withdrawal. Depending on the case, certain publications, for example
on paper, can continue to circulate. As far as possible, it is advisable to
respect the withdrawal of consent and implement measures to remove,
blur or hide the photo in question.

2.2.2. Exceptions to consent to publication
While it is always more appropriate to obtain the explicit consent of the person
concerned, consent is not necessary to proceed with the publication of a snapshot
in some cases :
- Freedom of expression and information protects the “right of the public to be informed, including
understood, in particular circumstances, on the private life of persons
public ” 14 .
o A public person (political or union actor, athlete, artist or
musician 15 ) is exposed to elements of his private life being published when
that these elements are justified from a press freedom point of view and
the right of the public to be informed.
o An anonymous person may, depending on the circumstances, become
momentarily a public person, when he is concerned by a
topical event. In principle, it has a right to be forgotten after a certain
time.
- Freedom of the press is specifically protected by the amended law of 8 June 2004
on freedom of expression in the media which specifies in particular in article 15 in
in which cases a professional journalist or a collaborator of a publisher can

13 Art.

38, Law of 10 August 1992 relating to the protection of young people ; art. 18, Law of 8 June 2004 on the
freedom of expression in the media ; Art. 383, 383bis, 385 Penal Code.
14 Art. 85 GDPR; art. 60 PL7184; art. 10 ECHR. See Court of Appeal, November 5, 2014, n ° 40644; Court of Appeal, 6
January 2005, n ° 26823 (so-called “M.” case). See also CourEDH, Österreichischer Rundfunk v. Austria , 7
December 2006; CourEDH , Eerikäinen et al. vs. Finland , February 10, 2009. The right to respect for private life can
nevertheless prevail when the information value is not demonstrated: CourEDH, Toma c. Romania , February 24
2009; CourEDH , Khmel v. Russia , December 12, 2013. Image rights can prevail even when the identity of the
the person was already known and the photo related to a public event: CourEDH, Egeland and Hanseid
vs. Norway , April 16, 2009, ECtHR, Axel Springer SE and RTL Television GmbH v. Germany , September 21, 2017.
15 The developments presented here are without prejudice to the copyright potentially at stake.

7

Page 9

communicate elements relating to the private life of a person without committing
responsibility.
o In particular, the publication of a photo (as "information relating to
with the private life of a person ” ) is admitted when it occurs occasionally
direct communication to the public, subject to compliance with certain
precautions.
- Freedom of artistic expression;
- Specific legislation and case law allow images to be
captured or published without the consent of the persons concerned.
o For example for reasons related to prevention, research and
finding of criminal offenses 16 .
o Legislation on identity documents.
The photos published in this way must nevertheless in principle respect the dignity of the person,
and, depending on the case, other principles and rights must be respected, such as the right to be forgotten.
In certain contexts, it may be prohibited to take and distribute photos of minors (for example,
example in judicial matters).

16 :

See in particular: Chamber of the Council of the Court of Appeal, judgment of 24 April 2012, n ° 254/12 .. However, the
publication must pursue a legitimate aim (for example the search for a fugitive or a suspect) (CourEDH,
Khuzhin et al. C. Russia , October 23, 2008).

8

Page 10

3. The treatment of an image as character data
staff
As indicated above, an image is personal data. His
processing falls under certain conditions within the scope of the legislation
concerning the right to the protection of personal data, in particular when the
photo is fixed and published outside of a private setting. Obligations arising from the GDPR
then apply to data controllers and processors who must fully
respect the rights of data subjects.
The GDPR applies to the processing of personal data carried out by a
controller or a subcontractor acting outside a private framework, that is
tell professionals (e.g. professional photographers), businesses (e.g.
companies operating social networks and online data hosting services),
administrations and associations.
Data processing is only lawful if at least one of the following conditions, provided for
in Article 6 GDPR, is fulfilled:
• The data subject has consented to the processing of their personal data
personnel for one or more specific purposes.
• The processing is necessary for the performance of a contract to which the data subject
is a party or to the execution of pre-contractual measures taken at the request of the latter
this.
• The processing is necessary for compliance with a legal obligation (clear and precise) to
which the controller is subject to.
• The processing is necessary to protect the vital interests of the person
concerned or another natural person.
• The processing is necessary for the performance of a task of public interest or relating to

the exercise of public authority vested in the controller.
• The processing is necessary for the purposes of the legitimate interests pursued by the

controller unless the interests or freedoms and rights prevail
fundamental aspects of the data subject that require data protection to be
personal character, in particular when the data subject is a child.
Most of the time, the data processing will be based on the consent of the person
concerned. The consent must be "free, specific, informed and unequivocal" thereof. The
the person concerned must therefore have a real choice. For minors, representatives
legal persons must give their consent. Regarding treatments included in the offer
direct information society services to children, consent of minors
of at least 16 years old is sufficient according to Article 8 GDPR and the consent of the holders of
Parental authority is therefore not required in this case.
Image rights and the right to personal data protection are two rights
fundamentals which are not subject to the same conditions: thus, if, in terms of the right to
image, tacit consent is allowed for the capture of the image, this is not the case in
data protection rights. Therefore, in the absence of consent

9

Page 11

explicit or a clear positive act when the picture is taken, a data controller must establish
its analysis on another condition of lawfulness provided for by the GDPR. A manager of
processing may, for example, invoke its "legitimate interests" . This condition of lawfulness
presupposes that the data controller takes due account of the "freedoms and rights
fundamental aspects of the data subject ” , such as, in the area under consideration, the
image rights.
The data processing may also be based on the other conditions of lawfulness (for
example: public interest, performance of a contract).
For example, a photographer may rely on the condition of lawfulness relating to the performance
of a contract when he takes identity photos or when he is hired for a photo
shooting.
Public authorities can invoke the public interest or the vital interest of the person
concerned when they publish the photos, for example of missing persons.
When the GDPR is applicable, i.e. the processing takes place outside the context
domestic and personal, the rights of the persons concerned must be respected: right
to information, the right of access, the right of rectification, the right to erasure, the right
opposition and the right to limitation, as well as, where applicable, the right to challenge a
decision taken on the basis of an automated process, the right to de-listing and the right to
data portability.

10

Page 12

4. Legislation
- Art. 8, 10, 17 ECHR
- Art. 7, 8, 54 Charter
- Art. 16 TFEU
- Art. 6, 85 GDPR
- Art. 11 (3), 24 Luxembourg constitution
- Art. 60 PL7184
- Law of 11 August 1982 on the protection of privacy
- Amended law of 8 June 2004 on freedom of expression in the media

- Amended law of April 18, 2001 on copyright, neighboring rights and the
data
- Amended law of 10 August 1992 relating to the protection of young people (minors: art. 38)
- Art. 383, 383bis, 385 Penal Code
- Art. 1382 and s. C. civ. / injunction

11

Page 13

NATIONAL COMMISSION FOR DATA PROTECTION
1, avenue du Rock'n'roll I L-4361 Esch-sur-Alzette
Phone. : (+352) 26 10 60 - 1 I Fax. : (+352) 26 10 60 - 29

www.cnpd.lu

12

