GDPR vs. webcam calls: Who wins?
What can an employer do when an employee refuses to turn on their webcam during online meetings, citing GDPR and image protection?
For many organizations, remote work has become an essential part of their operations—especially after the pandemic and its subsequent regulation in the Labour Code. With remote work have come numerous questions about the protection of employees’ personal data, including image protection during videoconference meetings. Let’s take a closer look at this issue based on a short case study.
Case study: Employee refuses to turn on webcam during online meeting
Background:
Organization "X" employs remote workers. Following the board's directive, the team manager introduced a requirement for employees to turn on their webcams during all meetings—both internal and with clients. One employee consistently refuses to turn on their webcam, citing GDPR regulations, the right to image protection, and the right to privacy. The employer’s argument for requiring the webcam includes: the need for active participation in meetings, the importance of visual communication in team-building, and the employer’s right to supervise the execution of work duties.
The problem: Can an employee refuse to turn on their webcam during online meetings? The answer: It depends!
- In many cases, yes — especially if online meetings are not regulated by internal policies (e.g., in the rules and regulations), and if the employee’s duties do not require visual contact.
- On the other hand, the employer has the right to supervise the employee’s work, issue instructions, and verify the employee’s ability to work or their location. Moreover, enabling the webcam is often justified by professional relationships or client requirements.
Therefore, this article explores the topic from both a legal and practical standpoint for employers.
An employee’s image is Personal Data
According to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), a person’s image is considered personal data if it allows for the identification of a specific individual. Additionally, Article 81 of the Polish Act on Copyright and Related Rights of 4 February 1994 states that the distribution of a person’s image requires their consent. If no clear reservation is made, consent is not required if the person has received an agreed payment for posing.
A video call is not the same as recording a meeting
It’s important to note that an employee turning on their webcam during an online meeting (e.g., a daily meeting) is legally different from the employer recording the meeting. Generally, enabling a webcam serves real-time communication and does not involve recording video or audio, so it is not considered surveillance and does not fall under specific legal regulations.
In contrast, recording a meeting (whether for internal or external purposes) constitutes the processing of personal data (image and voice) and is subject to GDPR and the Labour Code. In such cases, the employer must clearly inform the employee of the purpose and legal basis for the recording.
However, an employee can refuse to turn on their webcam during online meetings if there are no explicit provisions in internal policies or if their job does not require regular visual contact.
What about the employee's argument regarding household members’ privacy?
It’s worth noting that under Article 67^19 § 3 of the Labour Code, an employee who wants to work remotely is obligated to declare that they have appropriate conditions (both technical and spatial) to perform the work. This declaration should cover not only technical aspects but also a guarantee of respect for personal rights—both their own and those of third parties, such as household members. A counterargument is that most communication platforms (e.g., MS Teams, Zoom) offer background blurring or virtual backgrounds, significantly reducing privacy risks.
How can an employer legally process an employee’s image?
To legally process an employee’s image, an employer must rely on at least one of the following legal bases under the GDPR:
- Performance of a contract (Art. 6(1)(b) GDPR): If processing the employee’s image is necessary to fulfill work-related duties.
- Legitimate interest of the employer (Art. 6(1)(f) GDPR): If the employer’s interest outweighs the employee’s rights and freedoms—for example, to supervise work, assess the employee’s ability to perform duties, or verify their location (e.g., if there’s a suspicion the employee is under the influence or working from an unapproved location).
- Consent of the data subject (Art. 6(1)(a) GDPR): Particularly when the use of a webcam is not necessary for job duties, and there is no other legal basis—such as when the image will be disseminated. Consent must be freely given, informed, and revocable without negative consequences.
What can employers do when employees refuse to use webcam during online business meetings, citing image protection?
- First, identify the purpose of using the webcam—ensure that the requirement to turn on the webcam is justified by a specific goal and adheres to the principle of proportionality.
- Then, explain to the employee the purpose and legal basis for processing their image.
- Regulate video meetings in internal policies—clearly define when webcam use is mandatory. Suitable internal documents include:
- remote work regulations,
- remote work policies,
- individual agreements with employees.
- Require employees to use a virtual background with the company logo—this can eliminate arguments related to privacy violations.
- If webcam use is essential for a specific job, this requirement should be included in the employment contract.
Author: Legal trainee Maria Chmielewska-Pilarska, RBR Law Firm, July 30, 2025