The Before-and-After Photo Request
A senior stylist completes a dramatic copper-to-platinum transformation on a 41-year-old secondary-school teacher. The client verbally agrees to 'a quick photo' for the salon's Instagram but adds, 'Don't show my face - I don't want the kids finding it.' The stylist takes a back-of-head photo and a side profile that includes the client's distinctive tattoo and part of her cheek. That evening the salon owner posts a carousel: the profile shot is third, captioned with the client's first name and the school where she works. By 9 a.m. the client messages asking for immediate removal and says she will complain. The post has 2,300 views and 14 comments, one from a pupil. The salon's social media policy says verbal consent is enough for hair photos and staff receive no GDPR training.
1. Identify the consent and data-protection failures in this situation.
Read the worked answer
The core failure is that consent was narrower than the use. The client agreed to a photo but expressly excluded her face; the side profile, tattoo, first name and workplace made her identifiable, and a pupil commented. Valid consent must be specific, informed, freely given and unambiguous, and it can be withdrawn. A policy saying verbal consent is enough is not sufficient: it does not define scope, duration, platforms or withdrawal. The salon also failed to train staff on data protection. Publishing the school and first name is unnecessary and increases identifiability. The owner should have checked the exact image and caption before posting. The fact the client said yes to a quick photo does not authorise a carousel or a workplace caption.
2. What should the salon do immediately and in the following weeks?
Read the worked answer
Remove the post immediately and confirm removal in writing. Apologise for the specific failure - publishing an identifiable image against the client's stated limit - without blaming the client or saying she agreed to a photo. Log the complaint, preserve the messages and post details for the salon's records, and assess whether the incident is a personal-data breach that needs reporting to the regulator; at minimum record the decision. Offer a face-to-face conversation and a clear remedy under the salon's complaints policy. In the following weeks, rewrite the consent policy: separate consent for face, name, location, platform and duration; use a signed or digitally logged form; allow withdrawal at any time; train all staff; audit existing posts and remove any without documented consent. Do not offer free services in exchange for deleting the complaint.
3. The client also asks for the back-of-head image to be deleted, even though she initially liked it. How should the stylist respond?
Read the worked answer
Honour the request without argument. Consent is not a one-off transaction, and the client's trust is more important than one image. Explain that the back-of-head image is less identifiable, but if she wants it removed, remove it and delete stored copies. Do not pressure her by mentioning the engagement it received or the salon's marketing needs. Ask whether she wants to discuss the wider complaint and confirm what has been deleted. Record the withdrawal. This also models good practice for staff: a client can change her mind, and the salon must make that easy.