A team photo on your website, images from your latest event on LinkedIn, surveillance cameras in the warehouse, a promotional video shot in your offices: every one of these situations involves personal information within the meaning of Law 25. The question comes up regularly, and the short answer is yes: as soon as a person is identifiable in an image, that image is personal information.
This guide explains what that means in practice for the most common business uses, and how to govern each one without paralyzing your operations.
The Principle: An Identifiable Image Is Personal Information
Law 25 defines personal information as any information concerning a natural person that allows, directly or indirectly, that person to be identified. A photo or video where a person's face is recognizable meets that definition. Other elements can be enough for identification: a distinctive silhouette, a uniform with a name, a licence plate, a context that leaves no doubt.
Quebec adds the right to one's image, rooted in the Civil Code of Quebec and the Charter of Human Rights and Freedoms. The Supreme Court's Aubry v. Éditions Vice-Versa decision established that in Quebec, publishing the image of a recognizable person without their consent can create liability, even without proven harm. Quebec is the most protective jurisdiction in North America for image rights.
The two regimes stack: Law 25 governs the collection, use, retention, and communication of images; the right to one's image governs their publication.
Common Business Situations
Employee Photos (Website, Intranet, Communications)
Publishing an employee's photo on your website or social media requires their consent. Three practical points:
- Consent must be free. The employment relationship creates an imbalance: an employee may feel obligated to accept. Refusal must carry no consequence, and that absence of consequence must be real.
- Consent must be specific. Consent for the website photo does not automatically cover paid advertising or future publications on other platforms.
- Consent is revocable. An employee (or former employee) can withdraw consent. Have a procedure for removing images, including archived versions and past publications to the extent reasonable.
Good practice: an image consent form separate from the employment contract, detailing the planned uses (website, social media, promotional material), with separate checkboxes and a clear statement of the right to refuse and to withdraw.
Company Events and Conferences
Photographing an event and publishing the images involves collecting the personal information of every identifiable person. The defensible practices:
- Clearly notify at registration and at the entrance that the event is being photographed and images may be published (visible signage, mention in the registration confirmation)
- Offer a realistic opt-out mechanism: a no-photo zone, a distinctive badge, or a removal email after the event
- Avoid close-ups of people who have not explicitly consented, and favor wide shots where individuals are not the main subject
Entrance notice is not perfect consent for every use. For images intended for paid marketing or extended use, explicit consent from recognizable people remains the safe practice.
Marketing and Advertising
Images used in marketing get the highest level of scrutiny, for two reasons: it is direct commercial use of a person's image (image rights), and it is a distinct purpose that requires its own consent (Law 25).
In practice: no identifiable image in an advertisement without explicit, documented consent that specifically covers advertising use. This applies to customers, employees, and third parties. Stock images or contracted models eliminate the problem for major campaigns.
Video Surveillance
Surveillance cameras collect personal information continuously. The CAI has published specific expectations for video surveillance:
- Necessity: the surveillance must answer a real, documented need (security, asset protection), and less intrusive means must have been considered
- Proportionality: cameras cover the necessary areas, never private spaces (washrooms, locker rooms, break rooms)
- Transparency: visible signs disclose the presence of cameras and provide a contact point
- Limited retention: recordings are kept briefly (30 to 90 days is the usual range), then overwritten automatically
- Restricted access: only authorized people view the recordings, and each viewing should be justified and logged
Camera surveillance of employees follows even stricter rules: Quebec case law requires serious grounds for surveillance directed at workstations.
Internal Videos and Training
A recorded meeting, a webinar, a training video where employees appear: all require that participants be informed of the recording, its purpose, and its retention period. For limited internal use (replay for absentees), a clear notice at the start of the recording is generally enough. For broader use (publication, commercial reuse), explicit consent is required.
Minors: Maximum Caution
Images of children under 14 require the consent of the person holding parental authority. Between 14 and 18, the minor can consent alone, but prudence recommends involving parents for any public use. Organizations that work with youth (camps, private schools, sports clubs) should have a systematic, annual image consent procedure.
What About Photos Already Published?
The mistake is not fixed by deleting this guide from your history. If your organization has published images without documented consent, the reasonable path is gradual:
- Inventory the currently published images of identifiable people
- Prioritize requested removals and the most exposed uses (paid advertising)
- Document consent for the images you keep, or remove them
- Put the consent process in place going forward
The CAI evaluates the process, not retroactive perfection.
Quick Checklist
- [ ] Image consent form for employees (separate from the employment contract)
- [ ] Event capture notice (registration + on-site signage)
- [ ] Explicit consent for any advertising use
- [ ] Video surveillance signage and configured retention period
- [ ] Working consent withdrawal procedure
- [ ] Specific rules for images of minors
- [ ] Inventory of published images and their consent status
How Observantia Helps
Observantia documents image consents in the consent register, stores the signed forms, and the retention schedule covers video surveillance recordings like every other category of information. Start your 14-day free trial.
Related articles
- Consent and Law 25: What Changed for Collecting Personal Information
- Law 25 and Human Resources: What Changes for Employee Information
- Personal Information Retention and Destruction Policy Under Law 25
This content is provided for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a qualified legal professional.