The prior consent in the disclosure of promotional videos and agreements with marketing companies

The judgement of the Lisbon Court of Appeal, case no. 174/20.4T8PDL.L1-6 of 08.07.2021 penalized a company for the illegal publication of a promotional video recorded by another company at the request of the first company. The short video of 2 minutes and 45 seconds was published without the authorization and prior consent from the guardians of a minor who appears in the video for a few seconds.

In this particular case, the court condemned the first company which celebrated a services agreement for provisional of marketing services and the other party of this agreement, the company responsible for record the video and manage the commercial channels of the first company.

The right to personal image provided for in article 26 of the Portuguese Constitution and article 79 (1) of the Portuguese Civil Code has two aspects: the capture and distribution of personal image.

There is no doubt the contracted company which recorded the video and published it on behalf of the first company is responsible for the unauthorized disclosure of personal data. Regarding the first company, the court resorted mostly to the GDPR and the national law which implements this regime in Portugal to rule also against it.

The court determined that the use of personal image by the company that celebrated the services agreement is covered by the concept of “processing” personal data referred to in article 4 (2) of the GDPR. 

Thus, the use of promotional videos for marketing purposes constitutes responsibility for the controller of data. The controller cannot ignore what will be contained in the video released on its behalf and for its promotion by another company.

The Court based this decision on Article 24 (1) of the GDPR, which provides for the "Responsibility of the controller" in the section that states that "the controller shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is performed in accordance with this Regulation".

The Court concludes that those acting in their capacity as data controllers have a duty under the GDPR to ensure the protection of the personal data they use.

In the light of this interpretation, it is important for processors and companies be duly safeguarded when entering into contracts with other companies to provide services of Marketing, in order to implement all the necessary measures to not to be responsible for their actions and services.​