NAIH, Hungary’s Authority for Data Protection and Freedom of Information issued new guidance on the lawful use of employee photos. (Please click here for a link to the guidance – available in Hungarian only.) Employers are advised to review their data processing operations and update their internal privacy policies to comply with NAIH’s requirements.

In its guidance, NAIH emphasised that an employee photo can only be taken or processed lawfully if there is a specific underlying purpose. For example, the photo/processing may be lawful if the photo is necessary for a workplace entry system and the employer provided prior privacy information to the employees. Any additional disclosure requires an additional legitimate purpose.

Regarding group or event photos, NAIH claims that, based on an exception under civil rights law, it may not be necessary to obtain consent for the publication of photos on a website if the photos are taken of employees who attend an open, work-related event and the “image is not unique”. NAIH does not provide further details on this interpretation but recommends that employers investigate, on a case-by-case basis, whether a photo qualifies as a “crowd shot”. If it is not a crowd shot, consent from the relevant person must be obtained before publishing. Unfortunately, NAIH does not address what happens if the disclosure of the photo may be necessary for the employer’s legitimate interest but the employer cannot obtain the consent for some reason. It may also be difficult to assess the legality of consent, considering that its voluntary nature is questionable in the context of employment.

Laws: Act CXII of 2011 on the Right of Self-Determination in Respect of Information and the Freedom of Information, Act V of 2013 on the Civil Code, NAIH Statement No. NAIH/2016/2695/2/V.