Right to one’s own image, personality rights, and data protection in photographs

To consider

A photograph may involve several people who are protected by different legal rights. The person who took the photograph, who may not appear in it, holds the copyright in the photograph. At the same time, any person who is visible and recognisable in the photograph has rights protecting their image, personality, privacy, and personal data. The use or publication of a photograph may therefore affect both the photographer’s copyright and the rights of the people depicted. 

These rights are independent of one another. Having copyright in a photograph does not give the photographer unrestricted freedom to use or publish it. When sharing or publishing a photograph, the photographer or other copyright holder must also respect the rights of the people depicted. More specifically, people depicted in a photograph have a right to their own image, which protects their recognisable appearance in the photograph and is distinct from copyright. This right forms part of the protection of personality rights under Swiss civil law (Art. 28 Swiss Civil Code). People depicted in a photograph are also protected by the right to privacy and the protection of personal data. For federal institutions such as EPFL and ETH, these protections are primarily governed by the Federal Act on Data Protection (FADP) (Art. 3 et seq. FADP). For Swiss cantonal public higher education institutions, the applicable cantonal data protection legislation applies, such as § 3 et seq. and § 9 IDG of the Canton of Basel-Stadt

Understanding these rights and the protection they provide is important not only for taking appropriate steps to prevent unintended infringements, but also for understanding the possible consequences of non-compliance. Depending on the right concerned and the circumstances, violations may result in civil, criminal, or administrative consequences, including claims for damages. 

The following suggestions can help respect personality rights and protect personal data when working with photographs. 

The general rule: 

As a general data protection rule, a photograph depicting an identifiable person should not be published without that person’s consent, unless: 

  • the publication is justified by an overriding public or private interest, for example when reporting on a significant public event, such as a sporting event or concert, or in press coverage produced in accordance with journalists’ professional duties; or  
  • the publication is based on an applicable legal basis that specifies how and for what purposes such an image may be published. 
  • For public institutions, such as public higher education institutions, the publication of personal data may be justified where it is necessary to fulfil a public obligation. However, the mere fact that a university has a statutory mandate to promote and support research does not necessarily provide a legal basis for every processing operation carried out by researchers in the context of research activities. The applicable legal basis must be assessed in relation to the specific processing activity and the relevant data-protection legislation (federal or cantonal). 

Consent is valid only when it is given freely and on the basis of adequate information. When individuals are clearly identifiable in photographs, or when images are used in a sensitive context, they should be given the opportunity to view the images and be informed about the context and intended purposes of their publication. They should then be free to decide whether or not to consent to the publication. In certain cases, modular consent may provide a good compromise by allowing individuals to give consent separately for different types of use. 

As a general rule, personality rights end with the death of the person concerned and are neither transferable nor inheritable. In other words, upon the death of the person depicted, their right to their own image generally ceases to apply. However, the question of whether certain aspects of personality protection should extend beyond death has become increasingly relevant. To date, Swiss law has recognized the right of relatives to protect the memory of a deceased person (post-mortem personality protection). This may include protection against publications that seriously affect the relatives’ sensibilities, for example through the publication of images of the deceased person’s body or through a distortion of the deceased person’s image or personality (cf. Büchler, Die Kommerzialisierung Verstorbener, in AJP, 2003 p. 9 et seq.). 

Photographs taken in public spaces

For photographs taken in public places, different considerations may apply when the photographer is apparent to those present and individuals appear only incidentally, for example, passers-by photographed near a historical monument. In such cases, it may be sufficient to remove, anonymize, or refrain from publishing the image if the person concerned objects; there may be no need to expressly inform or approach them in advance. However, when sharing images, particularly in a research context, researchers should always take relevant ethical considerations into account. 

Photographs with public figures 

It is important to distinguish between a public figure’s private and public life. In general, images revealing information about the public activities of public figures, where that information has not already been made public by the person themselves, may be collected and used only for internal purposes (such as for analysis purposes) and should not be shared with the public. Such information may be further shared or published only where there is a prevailing private or public interest, such as in the context of press reporting or where there is a duty to inform the public (Art. 31 para. 2 lit. f FADP). Images containing details of a public figure’s private life should be afforded the same protection as other personal data, unless those details are directly relevant to their public activities.

(Joséphine Boillat, Stéphane Werly, in: Philippe Meier/Sylvain Metille (éd.), Commentaire Romand, Loi fédérale sur la protection des données, Basel 2023, Art. 31 N68 ss).