- Business in Poland -
Image rights infringement online – when is publishing a photo a crime?
Image rights infringement primarily means the unlawful dissemination of a person's likeness where the person can be identified and there is no legal basis for doing so, in particular no consent from the person shown in the photo. In certain cases, even recording a person's image may be unlawful. In online practice, this most often concerns publishing photographs on social media, news websites, advertising materials, an employer's website or in sales communications.
Not every publication of a photo without consent is a crime. In many cases, it will primarily be a civil law infringement connected with the protection of image rights, personal rights and personal data. Criminal liability arises in specific situations, especially where the photo is intimate, was obtained through violence, deception or unlawful access to an account, or was used for harassment, blackmail or impersonation.
Image rights as personal rights and an object of legal protection
A person's image is a personal right protected under Articles 23 and 24 of the Polish Civil Code [1]. This means that a person whose photo has been unlawfully published may demand, among other things, the removal of the material, cessation of further infringements, an apology, compensation for non-material harm or payment of a specified amount for a social purpose.
Article 81 of the Polish Act on Copyright and Related Rights also applies [2]. This provision sets out the general rule that disseminating a person's image requires the permission of the person depicted, unless one of the statutory exceptions applies.
In media, employment and reputation-related matters, the context matters as much as the photograph itself. The same photo may be neutral in an event album, but unlawful in an advertisement, an article suggesting allegations or a post ridiculing a specific person. This is why cases involving personal rights and media law require an assessment of the content, the purpose of publication, its reach and its consequences for the person depicted.
Disseminating a person's image without consent: when is consent not required?
Consent to publish a photo should be specific, informed and cover a defined manner of using the image. Consent to take a photograph does not always mean consent to publish it online. Consent to publication on an intranet does not necessarily cover an advertising campaign on a social media platform.
However, the law provides for exceptions. Permission is not required for:
- disseminating the image of a person who received agreed payment for posing, unless that person expressly reserved otherwise;
- disseminating the image of a widely known person, if the image was captured in connection with the performance of public functions, in particular political, social or professional functions;
- disseminating the image of a person who is merely a detail of a broader whole, such as an assembly, landscape or public event.
These exceptions do not apply automatically in every case. A photo of a public figure taken privately, with no connection to a public function, may still require consent. Similarly, a conference participant may be a "detail of the whole" in a wide shot of the room, but not necessarily in a close-up used in promotional material.
When is publishing a photo without consent a criminal offence?
The most important criminal law provision concerning image rights is Article 191a of the Polish Criminal Code [3]. It criminalizes recording the image of a naked person or a person during sexual activity using violence, unlawful threat or deception, as well as disseminating such an image without that person's consent. In this case, publishing a photo without consent may result in criminal liability, independently of civil liability.
Using someone else's photo to impersonate another person may also constitute a criminal offence. Article 190a § 2 of the Polish Criminal Code covers situations where the perpetrator impersonates another person by using their image, other personal data or other data by which that person is publicly identified, with the aim of causing material or personal harm [3]. This applies, among other things, to fake profiles, recruitment scams, actions targeting reputation or attempts to take over business contacts.
If the photo was obtained through unlawful access to an email inbox, phone, cloud storage or social media account, Article 267 of the Polish Criminal Code, concerning unlawful acquisition of information, may be relevant [3]. The subsequent publication itself may be one element of a broader unlawful act.
A person's image may also be used in a defamatory or insulting publication. Depending on the wording, context and consequences, Articles 212 or 216 of the Polish Criminal Code may apply [3]. In such cases, the issue is not merely the fact that a face was shown, but the message that harms the person's reputation, dignity or the trust required to perform a function, profession or business activity.
Publishing an employee's photo without consent
In a business environment, photos of employees create particular risks. A photograph in an email signature, on a company website, in social media or in recruitment materials may require a separate legal basis. An employee's consent should be voluntary, and the voluntary nature of consent in an employer - employee relationship is often assessed rigorously.
In HR practice, it is also important whether the photo continues to be used after employment ends. Continuing to present a person as a team member, sales representative or company expert may infringe their rights and mislead the audience. A broader discussion of this risk is presented in the analysis concerning criminal liability for sharing an employee's image without consent.
GDPR and image rights infringement online
A person's image may constitute personal data if it allows a natural person to be identified. In such cases, publishing a photo also requires assessment under the GDPR [4] and the Polish Personal Data Protection Act [5]. This is particularly relevant for organizations that systematically use photos of employees, customers, event participants or contractors.
A breach of personal data protection rules does not always constitute a criminal offence. However, it may lead to a complaint to the President of the Personal Data Protection Office, as well as administrative, civil or organizational liability. In certain cases, Article 107 of the Polish Personal Data Protection Act may also apply, concerning the processing of personal data where such processing is inadmissible or where there is no authorization to process it [5]. The assessment depends on the facts of the case.
How to respond to the unlawful dissemination of a photo
In the event of image rights infringement, it is crucial to secure evidence quickly. The perpetrator's removal of the post does not always end the matter, especially if the material has been copied, shared or used in a campaign.
The most commonly recommended actions include:
- securing screenshots, URLs, publication dates and profile details;
- determining who published the photo and on what basis;
- sending a demand to remove the material and cease further infringements;
- reporting the infringement to the platform administrator;
- assessing civil claims, a notice of suspected criminal offence or a complaint to the Polish Personal Data Protection Office.
In corporate matters, it is also worth reviewing marketing, HR and compliance procedures at the same time. Missing consents, outdated forms, uncontrolled photo archives and publications across multiple communication channels increase the risk of disputes and reputational costs.
This material is for information purposes only and does not constitute legal advice. In the event of a dispute concerning the dissemination of a person's image without consent, publishing a photo without consent or the risk of criminal liability, an individual analysis of the documents and the publication context is advisable. Such an analysis may be carried out by Kopeć & Zaborowski Law Firm after contact through the KKZ website.
FAQ - image rights infringement online
Is every publication of a photo without consent a crime?
No. Most often, it is a civil law infringement, especially under Article 81 of the Polish Copyright Act and Articles 23 and 24 of the Polish Civil Code. A criminal offence may occur, among other things, in cases involving the publication of intimate photos, impersonation, persistent harassment or obtaining a photograph through unlawful access to an account.
Does consent to take a photo mean consent to publish it?
Not always. Consent to take a photo and consent to disseminate it are separate issues. The scope of consent should cover the purpose, publication channel and period of use of the image.
Can a photo of a public figure be published without consent?
Yes, but only within the limits of the statutory exception. The image of a widely known person may be disseminated without consent if the photo was taken in connection with the performance of that person's public, professional or social functions.
Can a photo from a conference be used in company advertising?
It depends on the framing and the purpose. A wide shot of a public event may fall within the statutory exception, but using a close-up of a specific person in advertising usually requires consent.
What are the consequences of publishing an intimate photo without consent?
Publishing the image of a naked person or a person during sexual activity without their consent may constitute a criminal offence under Article 191a of the Polish Criminal Code, punishable by imprisonment from 3 months to 5 years. Civil claims for the protection of personal rights may also be available.
Can an employee's image be placed on the employer's website?
As a rule, this requires an appropriate legal basis, most commonly the employee's consent. Consent should be specific and voluntary, and after employment ends, further use of the photo requires reassessment.
Bibliography
- [1] Act of 23 April 1964 - the Polish Civil Code, Articles 23 and 24.
- [2] Act of 4 February 1994 on Copyright and Related Rights, Article 81.
- [3] Act of 6 June 1997 - the Polish Criminal Code, in particular Articles 190a, 191a, 212, 216 and 267.
- [4] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 - General Data Protection Regulation, GDPR.
- [5] Act of 10 May 2018 on Personal Data Protection, in particular Article 107.
Author: adw. Maciej Zaborowski, Managing Partner
E-mail: m.zaborowski@kkz.com.pl
