Posting CSR Event Photos on the Company Page: Whose Consent?

The corporate communications team comes back from handing out school supplies in the provinces with three hundred photos. By evening the album is on the company page: an executive passing a gift bag to a seven-year-old, the head teacher, a grandmother who came to collect her grandchildren. The caption names the school and the children who received scholarships. Nobody on the team asked whether the people in the pictures knew their faces would sit on a page with tens of thousands of followers.

One company put that question to the Office of the Personal Data Protection Committee (the PDPC Office) directly, in the consultation titled Company V's query on guidelines for publishing CSR activities on social media. Company V runs CSR programmes regularly and wanted to publish them on its corporate Facebook page. The sub-committee that answers queries replied in eight pages. This article turns that reply into the things marketing, PR, HR and agencies have to do, with the statutory text that sets the price of not doing them.

Is a photo of someone at a company event personal data?

Yes, if the person can be identified from it. The PDPC opened its reply to Company V on this point: a still or moving image of a person from which that person can be identified is personal data within the definition in Section 6 of the Personal Data Protection Act. Shooting it, filming it and putting it on a website or social media is therefore collection, use and disclosure of personal data, all three.

The PDPC had already said the same in an earlier consultation from a police station, about someone who copied another person's face photo onto a public Facebook post.

The PDPC also fixed the company's status at the outset. Company V is a juristic person that decides for itself whom to photograph, which images to keep and where to post them, so it is the data controller under Section 6. Every duty sits with the company. Not with the photographer, not with the school that lent its yard, and not with the platform.

What did Company V ask, and in what order did the PDPC reason?

Company V asked four questions. The PDPC answered the first three together.

1. Does publishing participants' names, photos and videos on social media need prior consent, and in what form should proof of consent be kept?
2. Where participants are young people or community members who are not employees, how should their rights be protected?
3. Are there examples or best practices for publishing CSR activities, including PDPA signage?
4. Any other advice on publishing in line with the Act.

The reply does not start with consent. It works in sequence. First the lawful purpose: why are you shooting, for example to publicise results and build the organisation's image. Then collect only what that purpose needs under Section 22. Then tell data subjects the details before or at the time of collection under Section 23. Use and disclose only for the notified purpose under Section 21. And at every step have a lawful basis under Section 24 or Section 26, read with Section 27, paragraph one.

When can event photos be posted without consent?

When the company has assessed the posting and it meets the conditions of legitimate interest. The PDPC told Company V to choose its basis with the relationship between the company and each data subject in mind, and pointed to Section 24(5) as a basis that might serve for both employees and outsiders.

The three-part assessment the PDPC set out

The PDPC suggested a Legitimate Interest Assessment (LIA) built on three criteria.

1. Purpose test. Are the reason for, and the benefit from, shooting and posting lawful? Publicising results and building the organisation's public image is the example the PDPC itself gave of a purpose that can be claimed.
2. Necessity test. How much disclosure does that purpose really need, and is there another way that affects the data subjects' rights less? Wide shots, shots from behind, or hands planting a tree are obvious candidates.
3. Balancing test. Weigh the company's interest against the rights of the people pictured. It must not unduly affect their rights and freedoms, the right to privacy above all, and must take account of the expectation of privacy they are entitled to in that setting.

If all three are passed, the PDPC said the company may collect, use or disclose without consent under Section 24(5) read with Section 27, paragraph one. The word "may" matters, because the party that has to prove the weighing was done is the company. If a complaint arrives and there is not a single page recording the assessment, it will be hard to say the basis was properly used. A step-by-step method is in legitimate interest in three questions.

When the PDPC thinks consent is the better course

At the end of its reply the PDPC pulled every factor together: the publicity purpose, necessity, the effect on privacy, the expectations of those pictured, whether they are minors or vulnerable, data minimisation, and the wide reach of social media. Its conclusion was that, where appropriate and feasible, the company should consider one of three routes.

• Ask the data subject for consent instead of relying on a Section 24 exemption, and do it in line with Sections 19 and 20.
• Publish only general atmosphere images, as far as necessary, and avoid images from which a person can be identified.
• Use some other method with less impact on the person.

Who is in the photo, which basis applies, and what to do before posting?

The table is built from the reply to Company V. The middle column summarises the consultation. The last column is the AIPDPA team's own suggestion building on it, not the PDPC's words.

Section 26 data the photographer did not know they captured

The PDPC warned Company V that if a still or moving image has the character of Section 26 data, for example data about a participant's religious or philosophical belief, health or disability, the company should take special care. Its reason: handling such data inappropriately can seriously affect the data subject's rights and freedoms, unfair discrimination being the example given.

Many popular CSR formats sit close to this section: meals for bedridden patients, wheelchairs for people with disabilities, blood drives, religious merit-making. One clear face with a caption saying the person is a patient or disabled may be a public disclosure of that person's health data or disability. None of the exemptions in Section 26(1) to (5) mentions the controller's legitimate interests. For more on this category, see sensitive data you hold without knowing.

Children, people with disabilities, the disadvantaged: what more is required?

Special care, both in the balancing and in how consent is obtained. The PDPC's wording is that the company must exercise special care with minors, persons with disabilities, incompetent persons, quasi-incompetent persons, the disadvantaged and vulnerable persons who lack the ability to protect their own rights and interests.

If you choose consent, who gives it?

The PDPC answered through Section 20 of the PDPA. For a minor who has not attained legal age, where giving the consent is not something the minor may do alone under sections 22, 23 or 24 of the Civil and Commercial Code, consent of the person exercising parental power is required as well. Where the minor is ten or under, consent must be sought from the person exercising parental power who has authority to act for the minor. For adults whom a court has declared incompetent or quasi-incompetent, paragraphs two and three of Section 20 name who consents.

A class teacher, a school director or a foundation worker who brings children to the event is not on the Section 20 list. The reply to Company V does not mention them, so a company should not decide for itself that the school's signature stands in for the parents'. The workable route is to ask the school to send the consent letter home before the day. Ages and who consents are covered in children's data and parental consent.

This matches what the PDPC told a bank, in a consultation published in anonymised form, about marketing to customers who are minors. There it had regard to the minor's maturity and to the consequences of the decision, and took the view that consent from the person exercising parental power should be obtained as well. Putting a child's face into corporate publicity is likewise a decision whose consequences a child can hardly judge.

If you rely on legitimate interest for photos of children

The PDPC did not close this route. It set the weights. In the balancing test the company should give particular importance to the rights, freedoms and interests of minors, because a minor may be less aware of risks and consequences than an adult and less able to protect those rights. The same weight goes to incompetent and quasi-incompetent persons.

The sub-committee also made an observation about context, using two pictures, and said the two may affect rights and freedoms differently. Teams should hold their own events up against them.

What must people be told on the day?

The Section 23 details, before or at the time of shooting, and specifically enough. The PDPC suggested that Company V put up signs in the activity area stating that still or moving images of participants are being recorded there. Where outsiders take part, the company should make the purposes, the details and the lawful basis clear, so that participants can find them easily.

The sign can be short. The PDPC accepted a brief sign backed by the full Section 23 details in another easily reached form: a handout at the registration desk, a website notice, a QR code or an email. The methods it listed also include a letter, SMS, an oral announcement and a phone call. It referred Company V to the Committee's guideline on notifying purposes and details, issued under Section 16(3), and to the Office's public infographics on training and seminar events and the PDPA.

• A specific purpose. The PDPC told Company V to avoid overly broad purposes, especially one that covers every kind of activity. Say the images are for publicising this event on named company channels (Section 23(1)).
• What is collected and for how long. Stills, video, names, and how long they will be kept or stay published (Section 23(3)).
• Who may receive it. Agencies, photographers, the press, and the public who see the post (Section 23(4)).
• The controller and contact details. Company name and contact channel, and the DPO if there is one (Section 23(5)).
• The data subject's rights. The rights to object and to erasure above all, with a way to exercise them on the day (Section 23(6)).

The notified purpose binds the company from then on. The PDPC explained that Section 21 allows use and disclosure only for the purpose notified. If next year the sales team wants villagers' photos from a CSR day in a product brochure, that is a new purpose. It needs notice and consent first under Section 21, paragraph two (1), or a law that permits it under paragraph two (2).

How should proof of consent be kept?

Company V asked this outright. The PDPC did not prescribe a form. It said consent must comply with Sections 19 and 20. Section 19 requires the request to be explicit, in writing or by electronic means; clearly distinguishable from other matters and in plain language; and as easy to withdraw as to give. Its last paragraph states what happens when the request is made the wrong way.

Read as a whole, Section 19 points to a document or electronic record showing who consented, to which use of the image, on which channels, when, and how to withdraw. For a child it must show that the signatory is the person exercising parental power. The elements of valid consent are set out in the valid consent guide.

Someone asks for a photo to be taken down after posting. What now?

Where the company relied on Section 24(5), the person pictured may object under Section 32(1) at any time. The PDPC noted for Company V that a person with authority to act under Section 20, such as the person exercising parental power over a child, may exercise the right too. Once an objection arrives, the burden of proof is on the company. The sequence below follows the PDPC's explanation.

1. Immediately on notice
   Separate that person's photos and videos clearly from other data. In practice: hide the post or pull the image from the album first, and log the time of the objection and who made it.Section 32, paragraph two
2. Assessment
   Can the company prove a compelling legitimate ground, or that the use is needed to establish, exercise or defend legal claims? For a publicity photo such grounds are hard to find.Section 32(1)(a), (b)
3. If it cannot be proved
   Stop collecting, using and disclosing the image. The data subject may ask for it to be erased, destroyed or anonymised, for example by blurring the face or cropping the person out.Section 32, paragraph two · Section 33, paragraph one (3)
4. Chasing copies already out there
   Because the company made the image public, the company is responsible for the technology and the cost of complying, and must inform other controllers that picked it up: partner pages, media that ran the press photo, the school's website.Section 33, paragraph three
5. If the objection is rejected
   Record the rejection and the reasons in the record of processing activities (RoPA).Section 32, paragraph three · Section 39
6. If the company does nothing
   The data subject may complain to the expert committee, which can order the company to erase or anonymise.Section 33, paragraph four

This paragraph is the strongest business reason to think before posting. An image goes on the page, gets shared, is picked up by local media, is cut into the agency's year-end highlights reel. When a parent later asks for removal, the chasing and the whole cost fall on the company. Where consent was the basis, withdrawal leads to the erasure right under Section 33, paragraph one (2) in the same way. The full workflow for rights requests is in answering data subject requests.

Is posting on social media also a cross-border transfer?

The reply to Company V does not address it, so there is no PDPC view yet on whether posting photos on a social media platform is sending or transferring data abroad under Section 28. Another consultation does supply a test: the query from the Office of Small and Medium Enterprises Promotion (OSMEP) on publishing personal data and cross-border publication in a pilot for a single ASEAN business identification number (UBIN).

That project would connect member states' company registries through a central API gateway without storing data on the portal. The data shown would include directors' and shareholders' names. The PDPC compared the facts with the definition in the Committee's notification on transfers abroad and took the view that, gateway or not, recipients in the destination country can access the data, so it is a sending or transfer of personal data abroad under Sections 28 and 29.

On UBIN the PDPC also said the agency holding the data must follow its own specific legislation first and the PDPA in addition, and before any transfer must make its Section 23(1) and (4) notice cover the purpose and the categories of recipients abroad, disclose only what is necessary under Section 22, and secure the data under Section 37(1). For a business owner whose name appears as a director or shareholder, the consultation confirms that the data stays under the PDPA's protection even when a state agency discloses it across borders.

A company posting event photos should read the two consultations together, cautiously. First, do not conclude on your own that a public post has nothing to do with Section 28; the PDPC has not said so. Second, where there is an obvious recipient abroad, such as raw files sent to an overseas editing studio or to a foreign parent company, the outsider-access test fits more directly, and the checks in sending data abroad under Section 28 apply. Third, say plainly in the event notice that the images will appear on social media that anyone can open. That last point is our suggestion.

What does the Act attach to getting it wrong?

Three tracks that can run at once: civil compensation, criminal penalties and administrative fines. The PDPC did not walk through penalties in its reply to Company V. It only warned that the Section 21 and Section 23 duties carry separate penalty provisions. The table therefore pairs conduct with the provisions of Chapters 6 and 7 as we read them in the corpus. All figures are statutory ceilings, not fines imposed in any case.

The criminal provision sits closer to CSR than people assume

Section 79 applies only to Section 26 data, so staff smiling by a backdrop are outside it. Photos of patients, of people with disabilities, or images that reveal a person's religious belief are the group for which this section has to be read. The elements are disclosure in breach of Section 27 and a manner likely to cause damage or humiliation. The word is "likely": actual harm need not have happened. Whether the elements are met depends on the facts of each case. Paragraph three of Section 79 makes the offence compoundable.

Civil liability: the person pictured need not prove intent

Under Section 77 a controller whose breach of the Act damages a data subject must compensate, regardless of whether the conduct was intentional or negligent. The only defences are force majeure, the data subject's own act, or compliance with an official's order. Paragraph two of Section 78 sets prescription at three years from when the injured person knew of the damage and of who is liable, or ten years from the wrongful act. A post left on the page is a risk the company carries for years.

Who inside the company stands where

Event-day checklist: before, during and after

The list combines the PDPC's advice to Company V with AIPDPA's own practice. Items that come from the reply or from the Act carry a section number. Items without one are our suggestions.

Five questions for the marketing team: fix whichever you cannot answer

1. For the latest CSR album on the page, which lawful basis was used, and can the LIA or the proof of consent be produced today?
2. How were people at that event told before they were photographed? Is there a picture of the sign or a copy of the handout?
3. How many images in the album show a child's face clearly, and is there consent from the person exercising parental power for each?
4. Does any image reveal the health, disability or religious belief of a person in it?
5. If a parent writes tomorrow asking for a child's photo to be removed, who takes the request, where must it be removed, and who tells partner pages and the media that used it?

A company that cannot answer three or more does not need to stop doing CSR or stop posting. What has to change is the step before pressing publish, and old posts need a second look too, because the Section 32 right to object can be used at any time and the Section 78 prescription period is counted in years.

A seven-day plan for a page with years of event posts

1. Day 1
   Go back through event posts. List the albums that show children, patients, people with disabilities, elderly people in care, or religious ceremonies.Section 26 · Section 20
2. Day 2
   Hide or edit the higher-risk images that have no proof of consent, starting with named solo portraits, and replace them with atmosphere shots.Section 22 · Section 27
3. Day 3
   Write the LIA for the general event photos that will stay up, separately for employees and outsiders.Section 24(5)
4. Day 4
   Produce the event kit: photography sign, full Section 23 notice, and consent forms for adults and for persons exercising parental power.Sections 19, 20, 23
5. Day 5
   Set the channel for objections and erasure requests, the owner, and the step for separating an image at once.Sections 32, 33
6. Day 6
   Amend contracts with agencies, photographers and organisers: images used only on the company's instructions, files returned or deleted after the job.Section 6 (definition of Data Processor)
7. Day 7
   Add event photography and publication to the record of processing activities, then train page admins and on-site staff with the checklist above.Section 39

What does this consultation leave unanswered?

The reply to Company V is the sub-committee's view on the facts the company put to it. It is not legislation and not a penalty decision, and most of its wording is at the level of "should consider" and "may", so each company still has to do its own assessment. Several points are not touched, and this article does not fill them in.

• What form of proof of consent is sufficient. The PDPC said only that Sections 19 and 20 must be met.
• The status of agencies, photographers, and schools or foundations that co-host: processor or joint controller.
• Whether a public post on a platform is a sending or transfer abroad under Section 28.
• The rights of people pictured under the Civil and Commercial Code or other laws. The PDPC cited that Code only on the capacity of minors, as Section 20 of the PDPA refers to it.
• Time limits for answering objections and erasure requests. The reply says only that the data must be separated immediately under Section 32, paragraph two.

Company event content raises two further issues that are not PDPA questions but usually arrive together: copyright in images and in the music behind a clip, covered in using photos, articles and music from the web, and reusing the attendee list for marketing messages, covered in marketing to existing customers.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)