The General Data Protection Regulation act, better known as GDPR, has defined personal data and a number of requirements for companies collecting, storing and managing personal data. Personal data is any information about an identified or identifiable person.
Portraits are considered a part of personal biometric data and categorized in the group of sensitive personal data. With the increasing use surveillance and security system, the use of face-detection systems is attracting more and more focus. It is expected that privacy around portraits will get a much higher attention when it comes to future revisions of the regulations and when companies are being GDPR autited by external companies.
Requirements for the company
With the increasing digitalization and use of portraits in many different company platforms, managing and handling employee portraits it has become much more critical for the company to comply with GDPR.
The Company has the obligation to:
- Collect individual employee consent for the company to use their portraits on marketing material, on web-sties and in internal systems.
- Manage change of consent from the employee during the employee journey
- Respond to request from the employee to identify where portraits are used
- Respond to request from the employee to delete portraits in all company systems.
- Manage individual employee consent for the company to use their portraits on marketing material, on web-sties and in internal systems.
- Manage change of consent from the employee during the employee journey
- Respond to request from the employee to delete portraits in all company systems, when the employee leaves the company.
In order to be GDPR compliant the company should therefore evaluate:
Where are the portraits stored – on a local PC or a central storage? Is storage made on a shared drive where everybody has access to the individual portraits? How do the company protect privacy and avoid copying and distribution? Are the portraits stored with at filename of the person? In which systems are they used? Does the company have consent from everybody and how do you keep track of this? How is the consent list updated when a new employee start or an existing employee leave the company or the organization. When using external photographers, does the photographer have systems and processes in place to handle portraits in compliance with GDPR, from photoshoot through processing and delivery.
Many systems will have their own functionality to support the system related GDPR compliance issues, but it is a tedious and time consuming task, to keep track on portraits across different systems and in different locations.
GDPR compliance through-out the employee journey
In terms of integration, Eikonice is very flexible and can be used in a semi-automated way – and still give the company the full advantage, when it comes to GDPR compliance. Full integration means that Eikonice stays updated via the company ADD or HR system. Upload of portraits to the company website and other digital platforms is done directly. For implementation of the integrated eikonice solution we need to have a dialogue with the IT-department to understand the IT-architecture and how we optimize the use of Eikonice. But in a Semi-automated solution, Eikonice will simply act as an external support for your photo processing – and integration to Eikonice will be done through uploads from excel/csv files and bulk downloads of final portraits to your server. In this way, Eikonice will still be an important and effective tool for you creating increased efficiency and savings, in relation to your current way of working.