Key Takeaways<\/h2>\n\n- The revised FADP<\/strong> (effective 1 Sep 2023<\/strong>) treats identifiable photos as personal data<\/strong> and operates alongside Art. 28 CC<\/strong>. Compliance programs must combine data\u2011protection<\/strong> and image\u2011protection<\/strong> duties.<\/li>\n
- Lawful bases<\/strong> go beyond consent<\/strong>. If relying on consent, it must be informed<\/strong>, specific<\/strong>, freely given<\/strong> and revocable<\/strong>. Controllers must document<\/strong> and justify<\/strong> the chosen legal basis.<\/li>\n
- Maintain auditable consent records<\/strong> showing controller, purpose and scope (channels and duration). Include retention rules<\/strong>, withdrawal procedure<\/strong> and timestamps. Store consent metadata<\/strong> with each image.<\/li>\n
- Apply extra safeguards for minors<\/strong> and high\u2011risk processing<\/strong>. Obtain explicit parental consent for commercial uses. Conduct DPIAs<\/strong> where appropriate. Use the editorial exemption<\/strong> only after a case\u2011by\u2011case balancing test.<\/li>\n
- Implement technical and organisational measures: encrypt<\/strong> images in transit and at rest, enforce least\u2011privilege access<\/strong> and logging, map transfers and safeguards. Treat face\u2011recognition<\/strong> tools as high\u2011risk and require documented justification.<\/li>\n<\/ul>\n
Lawful Bases and Documentation<\/h2>\nAcceptable Legal Bases<\/h3>\n
Controllers must record a clear lawful basis<\/strong> for processing images. Typical bases include:<\/p>\n\n- Consent<\/strong> \u2014 informed, specific, freely given and revocable;<\/li>\n
- Contract<\/strong> \u2014 processing necessary to perform contractual obligations;<\/li>\n
- Legal obligation<\/strong> \u2014 where a statute or regulation mandates processing;<\/li>\n
- Legitimate interest<\/strong> \u2014 after a documented balancing test showing interests do not override the data subject\u2019s rights.<\/li>\n<\/ul>\n
Documenting the Choice<\/h3>\n
For every processing activity, keep an auditable record that explains the chosen legal basis and the justification<\/strong> for it. This record should be retained and made available to supervisory authorities if requested.<\/p>\nConsent Records and Metadata<\/h2>\nWhat to Record<\/h3>\n
Consent records should be auditable<\/strong> and linked to each image. At minimum, record:<\/p>\n\n- Controller<\/strong> identity;<\/li>\n
- Purpose<\/strong> and scope (including channels and duration);<\/li>\n
- Retention rules<\/strong> and deletion schedule;<\/li>\n
- Withdrawal procedure<\/strong> and timestamps for consent\/grant\/withdrawal;<\/li>\n
- Any conditions<\/strong> attached to consent (e.g., limited to editorial or promotional use).<\/li>\n<\/ol>\n
Technical Implementation<\/h3>\n
Store consent metadata<\/strong> together with the digital asset (e.g., in the DAM or asset database) so each image carries its legal status, consent timestamps and applicable restrictions.<\/p>\nSafeguards for Minors and High\u2011Risk Uses<\/h2>\nMinors<\/h3>\n
Apply heightened safeguards<\/strong> when processing images of minors. For commercial uses, obtain explicit parental consent<\/strong> and verify parental authority where feasible.<\/p>\nHigh\u2011Risk Processing<\/h3>\n
High\u2011risk uses (e.g., profiling, public dissemination, or use with face\u2011recognition) require additional measures:<\/p>\n
\n- Conduct a Data Protection Impact Assessment (DPIA)<\/strong> where appropriate;<\/li>\n
- Apply technical protections, anonymisation or pseudonymisation where possible;<\/li>\n
- Limit access and perform regular risk reviews.<\/li>\n<\/ul>\n
Editorial Exemption<\/h2>\n
Use the editorial exemption<\/strong> only after a documented, case\u2011by\u2011case balancing test<\/strong> weighing public interest, freedom of expression and the data subject\u2019s privacy rights. Do not rely on it as a blanket justification.<\/p>\nTechnical and Organisational Measures<\/h2>\nEncryption and Storage<\/h3>\n
Encrypt images both in transit<\/strong> and at rest<\/strong>. Use secure key management and limit plaintext exposure.<\/p>\nAccess Controls and Logging<\/h3>\n
Enforce least\u2011privilege<\/strong> access using role\u2011based controls, multifactor authentication for privileged accounts, and comprehensive logging<\/strong> of access and processing events.<\/p>\nTransfers and Third Parties<\/h3>\n
Map any transfers<\/strong> of images to third parties and document contractual safeguards. Ensure adequate protections when transferring across borders.<\/p>\nFace\u2011Recognition and Emerging Tools<\/h3>\n
Treat face\u2011recognition<\/strong> and similar biometric tools as high\u2011risk<\/strong>. Require a documented justification, enhanced safeguards, and relevant approvals before deployment.<\/p>\nPractical Steps for Controllers<\/h2>\n\n- Update internal policies to reflect the revised FADP<\/strong> and Art. 28 CC<\/strong>.<\/li>\n
- Map image inventories and tag assets with consent metadata<\/strong>.<\/li>\n
- Implement technical controls (encryption, access control, logging).<\/li>\n
- Establish a process for DPIAs<\/strong> and for deciding when the editorial exemption<\/strong> applies.<\/li>\n
- Train staff on image\u2011specific duties and retention\/withdrawal procedures.<\/li>\n<\/ol>\n
If you want, I can draft a sample consent record template, an image\u2011processing checklist, or suggested DAM metadata fields to help operationalise these requirements.<\/p>\n
https:\/\/youtu.be\/MutNdlfq42Q<\/p>\n
Top legal takeaway: what changed and why it matters<\/h2>\n
The headline is simple: FADP (revised)<\/strong> \u2014 in force 1 September 2023<\/strong>. It tightened transparency<\/strong> and documentation obligations<\/strong>, raising consent standards<\/strong> and controller duties<\/strong>. I make that the starting point for every photo policy<\/strong> we review.<\/p>\nThe legal framework now<\/h3>\n
Identifiable photographs<\/strong> are personal data<\/strong>. That means the Swiss data-protection rules<\/strong> apply alongside image-specific rights. You must treat an identifiable photo like any other personal datum under the FADP (revised)<\/strong> \u2014 in force 1 September 2023<\/strong>. At the same time, civil-law image protection<\/strong> remains relevant via Swiss Civil Code Art. 28 \u2014 personality rights (image)<\/strong>. Both regimes can apply to the same photo. Controllers<\/strong> need to address both sets of obligations in the same compliance program<\/strong>.<\/p>\nLegal bases<\/strong> are broader than consent. Consider the following lawful bases and document your choice:<\/p>\n\n- Consent<\/strong><\/li>\n
- Contract<\/strong><\/li>\n
- Legal obligation<\/strong><\/li>\n
- Legitimate interest<\/strong><\/li>\n<\/ul>\n
Consent<\/strong> works, but it isn\u2019t the only lawful route. Document why<\/strong> you picked a basis and be ready to justify it. Transfers<\/strong> are easier because of EU adequacy recognition (Switzerland)<\/strong>, which reduces friction when photos move to or from the EU. That said, you still need records<\/strong> and safeguards<\/strong>.<\/p>\nPractical steps for controllers (actionable list)<\/h3>\n
Follow these steps to meet the revised transparency<\/strong> and accountability<\/strong> standards:<\/p>\n\n- Update privacy notices<\/strong> to name photography purposes and legal bases.<\/li>\n
- Keep auditable consent records<\/strong> and processing documentation that show who consented, when, and what they were told.<\/li>\n
- Run DPIAs<\/strong> for high-risk photo processing (publicity campaigns, identifiable children, profiling).<\/li>\n
- Map, document and limit retention<\/strong>: state how long images are kept and why.<\/li>\n
- Apply access and deletion workflows<\/strong> so requests about images are handled promptly.<\/li>\n
- Use appropriate contracts and security measures<\/strong> with processors who handle photos.<\/li>\n
- Put default minimisation in place<\/strong>: avoid collecting higher-resolution or identifying shots unless needed.<\/li>\n
- Train staff and volunteers<\/strong> on image rights and parental consent for minors. For practical guidance on supervising minors, link this with our notes on camp supervision<\/a>.<\/li>\n
- Maintain a clear opt-out mechanism<\/strong> for parents and subjects and log opt-outs in your records.<\/li>\n<\/ul>\n
I recommend a short compliance checklist<\/strong> tied to each photo use case. Keep one document per project that links purpose<\/strong>, lawful basis<\/strong>, DPIA outcome<\/strong>, retention period<\/strong> and consent logs<\/strong>. That single file becomes your first line in an audit<\/strong>.<\/p>\nOperational tips<\/strong> I use often: prefer written consent<\/strong> for publicity uses, timestamp all approvals<\/strong>, and encrypt storage<\/strong> of sensitive image archives. Where consent is relied on, include withdrawal instructions<\/strong> in the same place you ask for permission. For children, get parental consent<\/strong> and document age checks<\/strong>.<\/p>\n![\"Summer](\"https:\/\/youngexplorersclub.ch\/wp-content\/uploads\/2025\/11\/IMG_1589-Copy.jpg\" "\\"\\"")
<\/p>\n
When consent is required \u2014 taking vs publishing and common exceptions<\/h2>\n
We treat any image that can identify a person as personal data<\/strong>. Consent<\/strong> is required whenever we process those images and no other lawful basis applies. We always check<\/strong> whether another legal basis exists before relying on consent.<\/p>\nWe draw a strict line between taking<\/strong> photos and publishing<\/strong> or otherwise processing them. Taking<\/strong> an image in a public place is generally permitted. Publishing<\/strong>, profiling, sharing on social channels, or using an image in a brochure raises a higher legal risk and often triggers the need for consent<\/strong>. Commercial use<\/strong> \u2014 especially advertising \u2014 requires consent.<\/p>\nWe apply the editorial exception<\/strong> cautiously. Journalism or genuine public-interest reporting can be lawful without consent after a case-by-case balancing against Art.28 CC<\/strong>. We follow the FDPIC guidance<\/strong> tests and weigh:<\/p>\n\n- the public interest in dissemination<\/strong>,<\/li>\n
- the context and how the person is depicted<\/strong>,<\/li>\n
- the person’s notoriety and the likely damage to reputation<\/strong> (FDPIC guidance<\/strong>; Art.28 CC<\/strong>).<\/li>\n<\/ul>\n
We recommend these practical steps for every image that might identify someone:<\/p>\n
\n- Assess<\/strong> whether processing is taking place or just capturing.<\/li>\n
- Determine<\/strong> your lawful basis (consent, contract, legal obligation, legitimate interest).<\/li>\n
- Run<\/strong> the FDPIC tests<\/strong> on public-interest claims.<\/li>\n
- Document<\/strong> your decision and retention period.<\/li>\n
- Get explicit consent<\/strong> for commercial or promotional use.<\/li>\n<\/ol>\n
Illustrative hypotheticals<\/h3>\n
Below are quick examples we use to guide decisions:<\/p>\n
\n- Street photo used in news coverage of a public event<\/strong>: We\u2019d likely publish without consent if the image contributes to reporting, doesn’t humiliate the subject, and passes the FDPIC<\/strong> balancing test. Cite: FDPIC guidance<\/strong>; Art.28 CC<\/strong>.<\/li>\n
- Same street photo used on a billboard for a brand<\/strong>: We treat this as commercial processing<\/strong> and require explicit consent.<\/li>\n<\/ul>\n
Lawful Bases and Documentation<\/h2>\nAcceptable Legal Bases<\/h3>\n
Controllers must record a clear lawful basis<\/strong> for processing images. Typical bases include:<\/p>\n For every processing activity, keep an auditable record that explains the chosen legal basis and the justification<\/strong> for it. This record should be retained and made available to supervisory authorities if requested.<\/p>\n Consent records should be auditable<\/strong> and linked to each image. At minimum, record:<\/p>\n Store consent metadata<\/strong> together with the digital asset (e.g., in the DAM or asset database) so each image carries its legal status, consent timestamps and applicable restrictions.<\/p>\n Apply heightened safeguards<\/strong> when processing images of minors. For commercial uses, obtain explicit parental consent<\/strong> and verify parental authority where feasible.<\/p>\n High\u2011risk uses (e.g., profiling, public dissemination, or use with face\u2011recognition) require additional measures:<\/p>\n Use the editorial exemption<\/strong> only after a documented, case\u2011by\u2011case balancing test<\/strong> weighing public interest, freedom of expression and the data subject\u2019s privacy rights. Do not rely on it as a blanket justification.<\/p>\n Encrypt images both in transit<\/strong> and at rest<\/strong>. Use secure key management and limit plaintext exposure.<\/p>\n Enforce least\u2011privilege<\/strong> access using role\u2011based controls, multifactor authentication for privileged accounts, and comprehensive logging<\/strong> of access and processing events.<\/p>\n Map any transfers<\/strong> of images to third parties and document contractual safeguards. Ensure adequate protections when transferring across borders.<\/p>\n Treat face\u2011recognition<\/strong> and similar biometric tools as high\u2011risk<\/strong>. Require a documented justification, enhanced safeguards, and relevant approvals before deployment.<\/p>\n If you want, I can draft a sample consent record template, an image\u2011processing checklist, or suggested DAM metadata fields to help operationalise these requirements.<\/p>\n https:\/\/youtu.be\/MutNdlfq42Q<\/p>\n The headline is simple: FADP (revised)<\/strong> \u2014 in force 1 September 2023<\/strong>. It tightened transparency<\/strong> and documentation obligations<\/strong>, raising consent standards<\/strong> and controller duties<\/strong>. I make that the starting point for every photo policy<\/strong> we review.<\/p>\n Identifiable photographs<\/strong> are personal data<\/strong>. That means the Swiss data-protection rules<\/strong> apply alongside image-specific rights. You must treat an identifiable photo like any other personal datum under the FADP (revised)<\/strong> \u2014 in force 1 September 2023<\/strong>. At the same time, civil-law image protection<\/strong> remains relevant via Swiss Civil Code Art. 28 \u2014 personality rights (image)<\/strong>. Both regimes can apply to the same photo. Controllers<\/strong> need to address both sets of obligations in the same compliance program<\/strong>.<\/p>\n Legal bases<\/strong> are broader than consent. Consider the following lawful bases and document your choice:<\/p>\n Consent<\/strong> works, but it isn\u2019t the only lawful route. Document why<\/strong> you picked a basis and be ready to justify it. Transfers<\/strong> are easier because of EU adequacy recognition (Switzerland)<\/strong>, which reduces friction when photos move to or from the EU. That said, you still need records<\/strong> and safeguards<\/strong>.<\/p>\n Follow these steps to meet the revised transparency<\/strong> and accountability<\/strong> standards:<\/p>\n I recommend a short compliance checklist<\/strong> tied to each photo use case. Keep one document per project that links purpose<\/strong>, lawful basis<\/strong>, DPIA outcome<\/strong>, retention period<\/strong> and consent logs<\/strong>. That single file becomes your first line in an audit<\/strong>.<\/p>\n Operational tips<\/strong> I use often: prefer written consent<\/strong> for publicity uses, timestamp all approvals<\/strong>, and encrypt storage<\/strong> of sensitive image archives. Where consent is relied on, include withdrawal instructions<\/strong> in the same place you ask for permission. For children, get parental consent<\/strong> and document age checks<\/strong>.<\/p>\n We treat any image that can identify a person as personal data<\/strong>. Consent<\/strong> is required whenever we process those images and no other lawful basis applies. We always check<\/strong> whether another legal basis exists before relying on consent.<\/p>\n We draw a strict line between taking<\/strong> photos and publishing<\/strong> or otherwise processing them. Taking<\/strong> an image in a public place is generally permitted. Publishing<\/strong>, profiling, sharing on social channels, or using an image in a brochure raises a higher legal risk and often triggers the need for consent<\/strong>. Commercial use<\/strong> \u2014 especially advertising \u2014 requires consent.<\/p>\n We apply the editorial exception<\/strong> cautiously. Journalism or genuine public-interest reporting can be lawful without consent after a case-by-case balancing against Art.28 CC<\/strong>. We follow the FDPIC guidance<\/strong> tests and weigh:<\/p>\n We recommend these practical steps for every image that might identify someone:<\/p>\n Below are quick examples we use to guide decisions:<\/p>\n\n
Documenting the Choice<\/h3>\n
Consent Records and Metadata<\/h2>\n
What to Record<\/h3>\n
\n
Technical Implementation<\/h3>\n
Safeguards for Minors and High\u2011Risk Uses<\/h2>\n
Minors<\/h3>\n
High\u2011Risk Processing<\/h3>\n
\n
Editorial Exemption<\/h2>\n
Technical and Organisational Measures<\/h2>\n
Encryption and Storage<\/h3>\n
Access Controls and Logging<\/h3>\n
Transfers and Third Parties<\/h3>\n
Face\u2011Recognition and Emerging Tools<\/h3>\n
Practical Steps for Controllers<\/h2>\n
\n
Top legal takeaway: what changed and why it matters<\/h2>\n
The legal framework now<\/h3>\n
\n
Practical steps for controllers (actionable list)<\/h3>\n
\n
<\/p>\nWhen consent is required \u2014 taking vs publishing and common exceptions<\/h2>\n
\n
\n
Illustrative hypotheticals<\/h3>\n
\n
![\"Summer](\"https:\/\/youngexplorersclub.ch\/wp-content\/uploads\/2025\/11\/PXL_20250716_082942005-1.jpg\" "\\"\\"")
<\/p>\n