If the people on the photo are part of a crowd and can't be individually identified, you can publish the photo.

Else, the purpose of the image rather than the image itself should be your starting point.

If you intend to use the image to provide information about a certain aspect of CERN's activities, and the people who are photographed are essential, you do not need their written consent.
This could be the case for photos featuring persons having acquired a certain notoriety, e.g. a head of state, a famous actor, during their visit at CERN; or for the photo of CERN's Director-General at an official event of the Organization.

If the people are interchangeable and the photo is used as a genre image, you are required to obtain the written consent of the person concerned.

For purposes such as illustration of web sites (e.g. to show the ambience during lectures, the diversity of the participants, etc. to attract more candidates) the photo of an individual is not essential, but rather a “nice-to-have”. Therefore, you would not be able to demonstrate a legitimate interest.

In conclusion, consent would be the most appropriate lawful basis.

Please note that for being valid, the consent must be freely given, clear, unambiguous and separate from other terms. You have to inform the individuals about the purpose of the processing (that means: what will be done with the photo? Who has access? When will it be deleted?) when you ask them for consent. Individuals must actively opt in by ticking a box, signing a document, providing an affirmative response to a verbal statement etc. The evidence of consent must be recorded (when, where and how it was given).
And: Consent must be as easy to withdraw as to give!

And don’t forget, as controlling service you must document your processing operations in a RoPO!

When sending the invitation it should be made clear that:

1. Photos will be taken by the organisers.
2. The purpose of the photos (e.g. promoting the social activities of the department, experiment etc)
3. The destination of the photos, (e.g. CDS, Facebook, website) and their visibility (e.g. world-wide)
4. The retention period (e.g. 3 years online then archived or deleted)

And that by attending the party the individual consents to the use of the photos for this purpose. However, anyone who objects to their image being used in this way should contact the party organisers, who should remove or redact the appropriate photos before publication.

See also:
Procedure: Guidelines on the collection, use and storage of photos and videos
Procedure: Processing of personal data for event organisation