GDPR's Right to Erasure and a Former Brand Ambassador's Likeness

This is practical guidance from Make Influence, not legal advice. Use it as a checklist of what to consider — get the specific legal assessment of your own situation from a lawyer.

Two rights that don't automatically move together

When a brand ambassador relationship ends — on schedule or early — a brand is typically holding two separate things: a paid usage-rights licence to photos/video of the ambassador (what the contract governs), and the ambassador's own, independent GDPR right to erasure under Article 17. These rest on two different legal frameworks and don't move together automatically. A contract can't validly waive someone's statutory GDPR rights — but that doesn't mean every erasure request automatically beats a paid licence either. Which one wins comes down to one specific question: what legal basis was the image actually processed under?

A photo of a person is personal data — the legal basis decides the rest

A photo or video showing an identifiable person is personal data under GDPR, whether that person is an employee, a customer or a paid ambassador — as the general GDPR overview covers. What decides whether an erasure request has to be honoured isn't the content of the image, but which of the six lawful bases in Article 6(1) the brand actually relied on:

Two real Danish decisions — same logic, a different relationship

No published Danish decision yet deals specifically with an influencer or brand ambassador. But Datatilsynet, Denmark's data protection authority, has ruled twice on the structurally identical situation — a former employee's photo used in marketing — and both decisions show how the authority actually weighs the question:

Both cases show the same pattern: once an image is used for marketing and the legal basis actually was (or should have been) consent, the business consistently loses if it doesn't delete. But note the difference to a brand ambassador deal below — both cases are about employee photos, not a paid content licence.

Why an ambassador contract isn't the same case as an employee photo

The decisive difference: an employee's photo in a recruitment video is not necessary to perform the employment contract — which is exactly why both cases above needed a standalone consent as their legal basis, separate from the employment relationship itself. A brand ambassador deal is structurally different: the actual deliverable the brand is paying for IS sponsored content that shows the ambassador's likeness. That makes it far more defensible to treat the image processing as performance of a contract (Article 6(1)(b)) rather than as a separate consent — provided the contract is actually written that way, and a fee was genuinely paid for that specific use.

That has a direct consequence: an ambassador who wants an image removed mid-way through a valid, paid usage-rights period is in a weaker position than a former employee whose only legal basis was consent. There's no consent to withdraw. The Article 17(1)(a) erasure ground only kicks in once the purpose — the paid usage-rights window — has actually expired, or once the contract itself ends (through the brand's own termination, or through a breach that gives the brand grounds to terminate — see kill fees and early termination clauses in influencer contracts).

The real grey area: what if the ambassador ends things early?

This is where the practical disagreement this article is about actually happens. Say a brand has paid for a 6-month usage-rights licence on a campaign video, and after 2 months the ambassador wants to end the relationship — for reasons unrelated to the brand — and asks for every image to be removed immediately.

• If the legal basis genuinely was contract performance, and the contract (and the paid usage-rights window with it) is still in force: the purpose of the processing still stands. Article 17(1)(a) ("no longer necessary") isn't met yet. The ambassador's more realistic route is an Article 21 objection instead — but that only works if legitimate interest, not contract, was actually the basis, which typically isn't the case in a paid ambassador deal.
• If the contract itself ends — because the brand terminates it, because the ambassador breaches an exclusivity clause (see exclusivity clauses in influencer contracts), or because both sides agree to part ways — the purpose of the processing disappears with it. Article 17(1)(a) applies, and the brand should, as a rule, delete — regardless of what the usage-rights clause says in isolation about a 6-month period.
• If there was never a valid data-protection legal basis for processing the image in the first place — for example because the contract only ever addressed copyright/usage rights and never actually considered the GDPR basis — Article 17(1)(d) (unlawful processing) can apply independently of whether the contract is still running.

The practical takeaway: a paid usage-rights contract isn't a shield against GDPR — but it isn't irrelevant either. It decides which legal basis was actually in play, and that legal basis decides when the deletion obligation kicks in.

Decision framework

Hypothetical worked example

Illustrative example, not an actual Make Influence case. A brand pays an ambassador DKK 90,000 for a campaign video with a 6-month usage-rights licence for paid ads, planned as DKK 15,000/month of media spend spread evenly. After 2 months (DKK 30,000 delivered), the brand itself terminates the contract over a breach on the ambassador's side. The ambassador also asks for every image to be deleted.

Because the contract — and with it the purpose of processing the image — has now actually ended, Article 17(1)(a) is met: the brand should, as a rule, stop and delete. The remaining DKK 60,000 of planned media spend for months 3–6 can't run on that material, even though the contract originally granted 6 months of usage rights. Had the brand instead simply let the contract run its full course, the purpose of the processing — and with it the usage right — would have stood for the whole period.

Common mistakes

• Assuming a paid usage-rights contract is automatically a GDPR legal basis. They're two different frameworks — the contract can support "performance of a contract" as the basis, but only if it's actually written so the image processing is part of the contract's core deliverable.
• Using a model release/consent form "just to be safe" alongside a paid contract. Do that, and the ambassador now genuinely has a consent they can withdraw at any time — even though you also have a paid agreement.
• Assuming the relationship ending automatically deletes everything. Downloaded files and the contract itself don't disappear on their own — but the GDPR purpose for holding and showing a person's image can lapse even while the file still sits in your system.
• Confusing this with what happens when the influencer deletes their own post. That's a technical/contractual dependency, not a GDPR deletion obligation — see what usage rights do you keep if an influencer deletes their content or account.

Make Influence's perspective

In our experience, the legal basis for image processing is rarely thought through before an ambassador contract is signed — most contracts cover usage rights and fees in detail, but say nothing explicit about which GDPR basis the image processing rests on. That gap only becomes visible the day an ambassador asks for deletion mid-way through a paid period, and nobody can say clearly what the legal basis actually was. Our recommendation: write it into the contract itself — that the image processing happens as performance of the agreement, for the period and purposes the agreement sets out, see what to put in an influencer contract for the rest of what it needs to cover — so the question doesn't have to be answered for the first time once the relationship is already over.

FAQ

Can a former ambassador always demand images be deleted just because the collaboration is over?

No. As long as the paid usage-rights period is still running and the legal basis genuinely was contract performance, the purpose of the processing still stands, and a general deletion request doesn't automatically win. That changes once the contract itself ends.

Does the same logic apply if we never got a written consent, only a signed contract?

Yes — and that's actually the stronger position for the brand, provided the contract genuinely makes the image processing part of the contract's core deliverable. See the table above for why a separate consent weakens your position rather than strengthening it.

Should we always honour a deletion request, even when we think we're entitled to refuse?

No, but never refuse without actually working out which legal basis applies, and without legal advice — this article isn't a substitute for that, and Datatilsynet's two cases above show that businesses that refuse without a solid basis typically lose.

What about images already printed in physical marketing material?

The deletion obligation is mainly aimed at ongoing, active use — a live website, an active post, a running ad. Already-distributed printed material is a practically different case; stop any new distribution, and get specific advice on what applies to what's already gone out.

How does this relate to what we've paid for under the usage-rights contract?

The usage-rights contract and the GDPR right to erasure are two different frameworks that both apply at the same time — see what usage rights do you keep if an influencer deletes their content or account for the technical/contractual side of what happens to your material when something disappears.

Have the DMR A/S and Hadsund Apotek decisions ever been applied directly to an influencer?

Not yet in a published Datatilsynet decision — but both cases sit inside a wider, sourced timeline of Danish enforcement the Academy tracks. See has Denmark actually fined an influencer? every enforcement case, timelined for how these two GDPR decisions compare to the cases brought directly against a named influencer.