11.7 Poland and the EU: Image Rights, RODO, and Personal Data
Chapter 11.4 gave you the doctrine. This chapter gives you the text that actually applies if you operate from Poland or sell to people in the EU, which is the default assumption for this book because it is the stricter of the two regimes and the one with the sharpest remedies.
The pattern to notice before the detail: in the EU, likeness and personal data are personality rights, not property rights. The tools are consent, information duties, and remedies that do not require you to prove financial loss.
None of this is legal advice. It is the map of what to bring to a lawyer, and the checklist of things you can implement yourself this week.
Image rights in Poland: two statutes, one question
Two provisions govern the use of someone's likeness, and both apply to a persona.
Article 23 and 24 of the Civil Code protect personal interests (dobra osobiste), including image, name, and privacy. Article 24 gives the person whose interest was infringed a claim to stop the infringement, remove its effects, and — where the infringement was culpable — compensation for material damage and payment for the harm suffered. The important procedural feature: the claimant does not have to prove financial loss. Emotional harm is compensable on its own.
Article 81 of the Copyright Act is the specific rule. Disseminating a likeness requires consent, with defined exceptions: persons widely known where the image was made in connection with their public role, and persons who are a detail of a larger whole such as a gathering, a landscape, or a public event. Neither exception covers commercial use of a face as the basis of a character.
Three practical consequences follow, and they are where operators get caught:
Consent must be specific. Polish case law is consistent that consent to use a likeness covers the purpose, context, and form it was given for. Consent to appear in a photoshoot is not consent to train a model on the photographs. Consent to a still frame is not consent to a video, and neither is consent to a modified version that changes the impression the person makes. If you are building on a real person, the consent document must name training, derivatives, synthetic generation, media, territory, and term.
Consent can be withdrawn, and the burden is on you. Once the person withdraws it, continued use is an infringement. Your ability to show what was consented to, and when, is the whole defence. That document lives in the register from 11.4.
Posthumous interests belong to the family. Personal interests survive death in the hands of close persons, which is why post-mortem likeness use is a live risk rather than a technicality.
The practical rule for this book's recommendation: build the face from invented material and the question disappears. The three-tier structure from 11.4 is not a legal theory. It is the difference between a persona with no consent documents and a persona whose entire legal exposure is the terms of the image generator.
RODO: what changes when the persona talks to people
RODO — the The EU data protection regime, RODO in Polish; it governs chat logs, references, and consent records. as it applies in Poland, alongside the Data Protection Act of 10 May 2018 — is the regime that governs the chat layer, and it is the layer where a persona business accumulates the most regulated material. Fans disclose health information, sexual preferences, financial situations, and relationship details. That is special-category-adjacent data arriving voluntarily, and your job is to have a basis for holding it.
Is a face personal data? Yes. A photograph of an identifiable person is personal data, and a generated face is personal data too if it is linked to an identifiable person — including the operator, if the persona is tied to your identity, and including any real person whose likeness it resembles. It becomes biometric data in the RODO sense only when it is processed with technical means for the purpose of unique identification. Training a recognition model on faces is biometric processing and needs an Article 9 basis. Training a generator to produce a style generally is not.
Are the chats personal data? Yes, and this is the part operators under-think. Every conversation log is personal data about the fan. So is the inferred profile built on top of it: spending propensity, emotional state, topic preferences.
Your role is administrator (administrator danych, GDPR controller). You decide why and how the data is processed. Your model Under the AI Act, whoever develops an AI system or places it on the market under its own name., your hosting provider, and your analytics tool are processors, and each needs an agreement under Article 28 with the standard clauses, plus a named list of sub-processors. If a brand hires you to run a persona and the fan relationship is theirs, the roles may flip — decide that in the contract, in writing, before the first message.
The five obligations that matter in practice:
| Obligation | What it means for a persona account |
|---|---|
| Basis, Art. 6 (and Art. 9 where applicable) | Contract for the chat service; consent for marketing; explicit consent for health-adjacent data |
| Information duty, Art. 13/14 | A privacy notice reachable before the conversation starts, naming purposes, retention, and rights |
| Storage limitation, Art. 5(1)(e) | A defined retention period per data class, implemented as automatic deletion |
| Rights, Art. 15–22 | Access, rectification, erasure, portability, objection. You need a working process, not a policy page |
| DPIA, Art. 35 | Required for large-scale profiling or systematic monitoring. A chat persona that profiles emotional state is squarely in scope |
Retention, in working numbers. RODO sets no fixed period; it requires that you define one and honor it. A defensible default for a persona account:
- Conversation logs: 12–24 months from the last interaction, then deletion or full anonymization.
- Payment and invoicing records: per tax law — in Poland, five years from the end of the tax year in which the obligation arose. Bookkeeping beats privacy here; keep these.
- Consent and disclosure records: for the duration of processing plus the limitation period for claims. Five years is a working floor.
- Marketing consents: until withdrawal, plus proof of withdrawal.
Marketing to fans needs its own consent. Polish electronic communications law requires prior consent for commercial information sent by electronic means to a natural person — the rule that replaced Article 172 of the Telecommunications Law when the Electronic Communications Law took effect. [AS OF 2026-10] A fan following the persona is not consent to receive commercial information. Get the consent, store the proof, and make withdrawal one tap.
The regulator and the fines. The authority is UODO, and the ceiling is €20 million or 4% of total annual worldwide turnover, whichever is higher, for the serious tier. For a solo operator the realistic exposure is not the ceiling — it is a complaint from one fan, a proceeding that takes a year, and the obligation to demonstrate compliance you cannot demonstrate because you kept no records.
Two things that surprise operators
The advertiser carries the burden, not the model. In Polish practice, when a likeness appears in commercial communication, the party that used it has to show the consent existed. You cannot discharge that by pointing at the image generator's terms, and you cannot discharge it by pointing at a talent agency that supplied a file. The document has to exist, in your records, naming the use.
RODO follows the audience, not the company. If you operate the persona from outside the EU but you offer a service to people in the Union or monitor their behavior, the GDPR applies to that processing under its territorial scope rules. [AS OF 2026-10] A US-registered operator running a chat product for European fans is inside RODO, and the practical obligations — notice, basis, retention, rights, processor agreements — do not change because the company is elsewhere. This is the same extraterritorial logic as Article 50 in 11.1, arriving from the privacy side.
What to implement this week
- A privacy notice that names purposes, legal bases, retention periods, processors, and rights, linked before the first message in the chat flow.
- A retention schedule as a table with an implementation per row: which system deletes what, when.
- A consent record for every likeness source and every marketing list.
- A rights process: one email address, a response template, and a 30-day deadline you can actually meet.
- Processor agreements with every vendor in the chat The numbered folder convention such as 00-bible/ and 40-output/ that keeps every asset addressable., plus a written answer from each on whether they train on your data and how to disable it.
- A A data protection impact assessment, required for large-scale profiling such as a chat persona. outline if you profile users or run emotional-state inference at scale. Start it before you scale the chat product.
The recurring theme across all six: the defence is documentation created at the time, not reconstruction afterward. That is the same conclusion as 11.4 and 11.5, arriving from a different legal direction.
Where this goes wrong
Assuming a public profile is a license. Article 81 requires consent. Visibility is not consent.
Treating one consent as covering every use. Scope, purpose, and form are part of the consent. Training a model is a different use from publishing a photograph.
Running a chat product with no privacy notice and no retention rule. This is the most common state of an early persona business, and it is the easiest finding for a regulator.
Assuming the model vendor is responsible for the fan data. They are your processor. You are the administrator, and the notice is yours.
Confusing the processor relationship with the brand relationship. When a brand pays you to run their persona, the roles and the fan data ownership belong in the contract.
Storing the consent record with the file it justifies. Store both in the register, outside the tool that can be switched off.
The gate
- Which of your personas has a real person anywhere in its provenance, and where is the consent document?
- Can you produce, in one file, the The defined lifespan per data class: 12–24 months for logs, five years for invoices. for every category of fan data you hold?
- Who are your processors, and do you hold an Article 28 agreement with each?
- Where does a fan find your privacy notice before the conversation starts?
- If a fan requested erasure today, what exactly would you delete, and in how many systems?
What you leave with
The two Polish statutes that govern a likeness and what makes consent sufficient, the RODO obligations that attach to the chat layer, a retention schedule in working numbers, the marketing consent rule most operators miss, and a six-item list you can implement without a lawyer. Chapter 11.8 covers the other side of the same coin: what you owe consumers when you sell to them.