Beauty GDPR

Can't answer the GDPR comment for definite but I do think your boss has a point when they say they're their clients and not yours- you're employed by the salon and not freelance/ self employed. Also I think in some salons it's called out in terms and conditions that images may be used in promotional material (with consent of course). There'd be no comeback on this if a client kicked up a fuss that their images were used on a personal profile.

Could you agree a compromise and ask them to upload the photos to the business social pages with a comment "hair/ nails/ makeup/ whatever by Lauren92" ?

If the clients are idendifiable in the published images then you are processing personal data and all of the obligations of the GDPR and Data Protection Act apply. You (or the business) will be a Data Controller. I would not continue to publish any further personal data without a complete data protection impact assessment completed on the entire process.

Vetch wrote: »

Data Protection Impact Assessments are only required in high-risk situations. Photos of beauty treatments on social media where people are rarely recognisable wouldn't come within a country mile of the threshold for a DPIA.

OP, a GDPR 'issue' isn't necessarily the same as a 'breach'. A complaint about a posting on your social media could be made to the salon. They may also want to control their branding.

You don't know if a process is high risk unless you apply the screening questions. For all we know, this company could have hundreds of images online. The ICO recommends that it is also good practice to do a DPIA for any new process or project, which requires the processing of personal data. Fair enough, it might not be mandatory for this example, but DPIAs are quite straight forward. I would deem the publishing of customers' images by a business without a clear lawful basis to be at best, unprofessional and at worst, culminating in a data subject, exercising their rights by lodging a complaint with the DPC. That's why I indicated that a DPIA may actually assist, it could set out that the controller may be able to rely on legitimate interest instead of the dreaded basis of consent, once they have a privacy notice informing clients of their processing activities etc.

In my experience, some data protection 'issues' have turned into breaches and vice versa. Can never be too vigilant.

Op can find guidance on the DPC's website.

I think you need to take a step back and carefully consider your position as an employee. If you were self employed, it would be a slightly different matter.

You need to be aware of your obligations under Intellectual Property laws. Any work that an employee does in the course of their employment belongs to the employer and in law the employee cannot claim it as their own so effectively, they may not take pictures and post them on their social media accounts without the express permission of the salon owner.

Usually people think of Intellectual Property being about protecting Trade Secrets and new inventions which it does, but it also covers more mundane matters.

With regards to GDPR, any photos taken of clients must also have the client’s express consent before publishing them, whether online or otherwise. If I was the salon owner, I’d expect the client to at least tick a box on the consultation form giving permission to take and publish photos. In addition, an employee found in breach of GDPR can be prosecuted individually (as well as the salon owner), so it’s not a matter to be taken lightly.

beauf wrote: »

Can you link to any example of an individual being prosecuted as you suggest.

https://www.springhouselaw.com/knowledge/employee-prosecution-for-data-protection-breaches/

Although these are U.K. prosecutions, the EDPB promote consistency in the application of GDPR across member States so the DPC in Ireland will clearly have regard for such cases when carrying out reviews of application of GDPR at a National level.

You do know this was like 10 months ago when she asked this right? I think things have changed a lot since then what with Covid-19 and the whole Country having to shut down there is even no guarantee the company that she worked for is still in business. She could have her own business by now for all we know.

beauf wrote: »

Someone else might read this thread and find it useful.

True and good point.