0800 689 0831

School photographs and the GDRP

It has been over 12 months since the ICO issued 2 reprimands against primary schools for wrongly disclosing photographs of pupils without consent (Blog: Don't get caught out when it comes to pupil photos | ICO). However, in the intervening 12-month period there is still some confusion over the question of consent from pupils and the use of their photographs, particularly with secondary school pupils.

When is Consent Required?

Consent for photographs is only required in certain circumstances within a school setting. If photos are taken for personal use purposes (e.g. parents taking photographs of their child at a school event), they will not be covered by data protection law and consent is not required. Similarly, if photos are being taken in school, to be displayed within the school (e.g. for identification purposes or for displays), consent is not required.

However, if photographs are being used for marketing purposes (e.g. publication in a prospectus, a local newspaper or on social media) or being sent outside the school, then consent will be required.

School Photographs in a Primary Setting

Primary school aged pupils will be unable to give consent for the use of photographs and therefore consent should be obtained from their parents before photographs are published. Primary schools should have procedures in place to obtain consent for photographs from children and checks should be made to ensure consent has been obtained before any photographs of children are published outside the school setting.

School Photographs in a Secondary Setting

The age of a a pupil will be a consideration when determining who to seek consent from - either the parent or the pupil. This will depend on whether or not the pupil has the capacity to understand the implications of the use of their photograph. If they lack capacity to understand this then consent should be obtained by the pupil's parent or carer on their behalf. The general rule in the UK is whether the individual pupil has the competence to understand and consent for themselves (the 'Gillick competence test') and is generally considered to be around age 12 or 13 but will depend on each individual child.

This can cause some confusion and concern. However, a sensible approach would be to consider obtaining consent from parents for photographs at the time the pupil joins the secondary school (i.e. age 11) on the understanding that the pupil has the right to withdraw this consent at a later date if they wished to do so.

Practical Steps to Take

The ICO has published guidance which will be of use to schools, and many other organisations, when considering publishing photographs of pupils or other individuals we work with. These include:

Consider your lawful basis for publishing photographs - where photographs are to be published outside an organisation (e.g. for a prospectus or for use in the media), then consent is likely to be your lawful basis for processing under the UK GDPR;

Ensure you have a procedure for publishing photographs - this will ensure you check consent has been obtained to publish the photograph;

Report any breaches via your internal breach procedure - publishing photographs without consent is likely to be a data breach and will need reporting to your DPO who will then consider whether or not the breach needs to be reported to the ICO; and

Training - staff should be educated about your data protection policies and procedures on a regular basis.

Whilst the UK GDPR will not apply to photographs being used for personal purposes (e.g. parents taking photographs of their child at a school event), where photographs are being used by the school and sent outside of the school this will be subject to the UK GDPR. Therefore, you will need to ensure you have obtained consent to publish the photograph and train staff so that they are aware of this requirement.

For further advice and assistance, please contact Bethany Paliga via email - Bethany Paliga or call 0800 689 3206.

For more information contact Bethany Paliga in our Governance, Procurement & Information department via email or phone on 01254 222347. Alternatively send any question through to Forbes Solicitors via our online Contact Form.

Learn more about our Governance, Procurement & Information department here

CCTV, Personal Email Accounts & Loss of Paper Files: Lessons…

The rise of group data breach claims