Can you share photos of employees after the company party?

Is a photo of your colleague personal data?

Yes, as soon as somebody is recognisable in it. According to the explanation from the Dutch DPA you do not need to know that person's name: a recognisable build or a recognisable posture can already be enough.

There is an exception for personal use, but it only applies when somebody keeps photos private or shares them within a very small circle. It does not apply to you as an employer: the moment you collect and publish photos on behalf of the organisation you need a lawful basis, inside a private album as well.

Do you need consent, or is legitimate interest enough?

This is where the sources part company, and that explains the contradictory pieces you find about it. On its page about photographing and filming at events the Dutch DPA writes that consent is by far the most obvious basis, and that legitimate interest only comes into view when you cannot ask for consent.

Dutch employment lawyers point at the opposite problem. AWVN writes that consent carries requirements which, in an employment relationship, usually cannot be met because of the dependency between the two sides. The Dutch DPA says as much itself: there is a power imbalance, and whoever refuses may not suffer for it. DMCC notes that employers therefore often lean on legitimate interest, which does not square with the regulator's position.

So on Monday morning you do two things at once. Ask for consent and make refusing genuinely free: no list of who is opting out, and an equivalent alternative. Keep the purpose small alongside that, because a private album for colleagues is a different thing from an advertisement. If you do lean on legitimate interest, write the assessment down.

• Purpose: what you use the photos for, and where they will end up.
• Necessity: could it be done with fewer photos, or without recognisable faces.
• Interest: what goes wrong if this particular photo goes around.
• Safeguards: a private album, a retention period, an address for objections.
• Outcome: why your interest weighs heavier, with a date under it.

How does somebody withdraw their consent again?

This is missing from most pieces, while it is the question you get six months later. Withdrawing has to be as easy as giving, and the Dutch DPA offers an example with it: a button next to the photos for whoever is in them and does not want to be. No reason required.

And then the part people miss. According to the Dutch DPA such a request covers your own photo archive too, not only the website. If the album sits in six places, among them the marketing folder and a zip on somebody's private laptop, you have to know all six. One album in one place is the only setup in which you can deliver on this, and it is in the guide on collecting photos at a company party.

How long may you keep the photos?

There is no period in the law. The Dutch DPA explains that the GDPR sets no concrete retention period and that organisations decide it themselves. The starting point is fixed: no longer than you need for the purpose.

So you choose a period yourself and write the reasoning next to it. The Dutch DPA does not look at whether you land on twelve months or three years, but at whether your explanation is reasonable and whether you actually stick to it. For party photos the honest answer is shorter than people think: the purpose is that colleagues look back at the evening, and that is done after a couple of months. With us the active period runs out by itself, and what happens after that is set out separately.

Is portrait right a separate thing from the GDPR?

Yes, two tracks that run alongside each other. In the Netherlands portrait right comes from article 21 of the Auteurswet, the Dutch copyright act, and gives somebody in a photo the right to oppose publication when they have a reasonable interest in doing so. Pallas Advocaten writes that this reasonableness test lines up with the balancing of interests in the GDPR.

For a company party that gets concrete. According to that same piece, an atmospheric shot of an outing does not readily amount to a reasonable interest. But photos of a staff party that got out of hand are named as an example, including when they are published internally. That is the photo colleagues are afraid of, and the reason to turn moderation on or take something down.

Do you need a data processing agreement with your photo tool?

Almost always. The moment an outside party processes personal data on your instructions such an agreement is mandatory, and with a photo tool that is the case because with a SaaS service the data goes to another party's server. You remain the controller, the supplier is the processor.

It should cover the purpose, the duration, which data it concerns, and who does what in a data breach. That last part is not theoretical: a report has to reach the Dutch DPA within 72 hours. Ask for the agreement before you buy, and ask in the same breath where the files are stored, because that answer is missing at a lot of suppliers.