The image of a person who has given consent may continue to be used in the manner for which that person gave consent (e.g. if the person agreed to the publication of photos or videos on the website, then they may only be published on that website). Consent remains valid until it is withdrawn, and its withdrawal does not affect the lawfulness of processing based on that consent before it was withdrawn (i.e. actions taken before the withdrawal, such as using the image, are legal, but after the withdrawal, all such content must be removed). It is essential that the person, before giving consent, is informed that the consent may be withdrawn and that the withdrawal will not affect the lawfulness of processing carried out before the withdrawal.
However, the manner and conditions under which such consent was given are not without significance. The regulations specify the requirements for valid consent:
- the consent must be given through a clear, affirmative action indicating, in relation to a specific situation, the data subject’s voluntary, informed, and unambiguous agreement to the processing of their personal data, for example in the form of a written (including electronic) or oral statement;
- if the processing serves multiple purposes, consent is required for each of them;
- the controller must be able to demonstrate that the data subject gave consent to the processing of their personal data (which means the signed consent must be retained);
- if the consent is given in a written statement that also concerns other matters, the request for consent must be presented in a way that clearly distinguishes it from the other matters, in an understandable and easily accessible form, using clear and plain language.
If consent is given in a way that violates these requirements and thus constitutes a breach of the GDPR, such a declaration is not binding.
Of course, if the person does not withdraw their consent to the use of their image, the institution may still remove materials from the website or social media, if those materials are no longer useful for the pursued purpose, namely the promotion of the institution and its activities.