Consent form for photos

[ataylor]

I assume we need the same permissions from staff as they start employment? Do we have permission for their Biometrics & Photographs?

[Claireashton]

Yes, you need their consent in the same way. You will need to ask all staff if you use their photos on the website or send them to the press for whatever reason. One thing to be careful of with staff contracts is that they don't contain consent for the lawful basis of processing their data for the employment - they tend to. On May 25th, this would invalidate the contract. They need to be checked and updated to the lawful basis of performing the contract - as in, without their details you wouldn't be able to employ and pay them, it's not optional.

 

Biometric now fall under special category data and need special treatment. Here's a blog about it: https://www.itgovernance.eu/blog/en/gdpr-things-to-consider-when-processing-biometric-data

 

The ICO also issues information about this and they explain what kinds of biometric data is classed in this way: https://www.itgovernance.eu/blog/en/gdpr-things-to-consider-when-processing-biometric-data

[rom1984]

 

Biometric now fall under special category data and need special treatment. Here's a blog about it: https://www.itgovernance.eu/blog/en/gdpr-things-to-consider-when-processing-biometric-data

 

]

 

I like this blog post as it makes the point of mentioning that schools need consider do they really need to use Biometrics - this should be done before even thinking about what's the lawful bases of processing. A Data Protection Impact Assessment should be done if you do use Biometrics and you should address in it why you need to process the persons Biometrics to serve them lunch etc and what other less intrusive methods could be used, for example swipe cards, and why these wouldn't work.

[Claireashton]

I am glad it is useful. This is an example of one of many processes in school that should be looked at to see if there's a better way. A risk assessment helps everyone to see what the risks are and if they are worth taking, can be reduced or can be removed. Has anyone heard anything from the suppliers of systems using biometric data around GDPR?

[rom1984]

I am glad it is useful. This is an example of one of many processes in school that should be looked at to see if there's a better way. A risk assessment helps everyone to see what the risks are and if they are worth taking, can be reduced or can be removed. Has anyone heard anything from the suppliers of systems using biometric data around GDPR?

 

I've got a feeling suppliers of systems using biometric data won't be trying to shine a spotlight on the GDPR as the general advise from the ICO will be to question if you need biometric data to begin with and to look at alternative solutions.

[Katy]

I've got a feeling suppliers of systems using biometric data won't be trying to shine a spotlight on the GDPR as the general advise from the ICO will be to question if you need biometric data to begin with and to look at alternative solutions.

I always felt the push for things like biometric catering/library etc was "this exists now and is shiny" rather than "we actually need this". When we've had people trying to sell us on it in the past they couldn't come up with a good enough reason compared to the alternatives.

[rom1984]

Ohhh shinny new things, must buy. Reminds me of a head at an old school of mine, he had delivered 60 brand new iPads with carry cases. When delivered he then asked us which department needed them and how would they use them.

[Katy]

Ohhh shinny new things, must buy. Reminds me of a head at an old school of mine, he had delivered 60 brand new iPads with carry cases. When delivered he then asked us which department needed them and how would they use them.

Answer "nobody and they won't, you forgot to buy some wireless to go with that"

 

Just remembered the reason for going biometric the sales guy was relying on - "they won't lose their thumb!"

[MkII]

Biometric.. isn't the reason that it's cheaper and faster? Is cost a valid reason? A lot of things seem to boil down to that.

[Edutech98]

Biometric.. isn't the reason that it's cheaper and faster? Is cost a valid reason? A lot of things seem to boil down to that.

 

It can be a factor, as long as the school can show they have considered it and is it proportionate to the risk of processing special category data. If it can be shown that you can achieve your objectives for the same price, or relatively close, without using Biometric data, then that should be considered over Biometrics.

[DrCheese]

Is anyone further along with how they're going to manage consent from the pupils for photos? Annoyingly SIMS in it's current state doesn't really have much - The tickbox at the bottom of the account is only either ticked or not, there's no "opted out" which means if you run a report on it, you can't tell if that student has opt'd out, or if they've just not yet been sent the form/online system.

[mrhall]

Plan B - after some internal discussion - and after reading the DfES GDPR document released yesterday

(see page 23)

We're going to argue that a photo for internal use - for SIMS / school canteen and Edulink - this is part of our need for "essential for performing the public task of the school"

We're then going to ask once for publicity photos - and show the various different places that we've been publicised in this year - and ask for permission to continue....

 

Peter

[Claireashton]

That's right, they need to opt in and not opt out - this should always be the case where consent is the lawful basis for processing. Each potential use of the personal data should also be separated out, so if you use photographs on the website, as displays in the school, send them to the newspaper, add them to social media - each of these is a separate option. So people may say yes to the website and no to social media for example. The form should also explain how they withdraw their consent which needs to be easy, so maybe a specific email address. Also silence is now interpreted as a no and not a yes.

[minimoo]

That's right, they need to opt in and not opt out - this should always be the case where consent is the lawful basis for processing. Each potential use of the personal data should also be separated out, so if you use photographs on the website, as displays in the school, send them to the newspaper, add them to social media - each of these is a separate option. So people may say yes to the website and no to social media for example. The form should also explain how they withdraw their consent which needs to be easy, so maybe a specific email address. Also silence is now interpreted as a no and not a yes.

 

Sorry, but I'm going to be pedantic here - you state someone could see 'yes to the website, but no to social media' - but what is a 'website' and 'social media' - http://www.facebook.com is "a website". At some level people are going to need something that is somewhat generic, if not it's going to get unworkable.

 

You will end up with a form that starts to state: Do you consent to your child's photographs being on theschoolswebsite.sch.uk, Please confirm you are happy for the school to share the photo on a) facebook b) instragram c) twitter d) etc. The school may get asked to share your photo with a newspaper, are you happy for the school to share the photograph with the following news organisations: a) bbc, b) itv, c) sun newspaper, d) times newspaper. e) local independent . On occasions the school may be like to use the photograph on a site not listed above, in this case the school will contact you to ask.

 

If you take @mrhall's comment and reference to page 23 of the DFE's toolkit, along with covering the above, and the case study text of: "permission to retain beyond their time in school (if required) should be sought" and " Photographs used in promotion/marketing type material should seek specific

informed consent, and only be used in line with the consent provided" - does it not become easier to state in a policy:

 

Whilst a child is at schoool, we will store a photograph for identity purposes (of the child) on our internal MIS system and canteen. This photograph will be removed at the point the child leaves the school. Occasionally we may wish to use photographs of children on our website, or other promotional material, in this instance we will send you a copy of the photograph and ask for your consent to use the photograph for this purpose for each use.

 

In that way, there can never be any confusion, the school would always have evidence of consent for each use - the only downside might be that some parents may get multiple requests per year.

[Claireashton]

Sorry, should have been more precise, yes school website. Each process needs to be looked at to see which is more manageable for the school. If contacting parents, pupils or staff each time you want to use a photograph is easier than being specific in the consent form then do that. The DfE states 'specific informed consent' which is not specific about what specific means. Ultimately, everyone is interpreting the Regulation and until there is case law this is all we can do. But it needs to work for your school and be documented as to why decisions have been made

[TMBS]

At the GDPR training held by our local LEA they advised that if consent for photos is asked for publicity, website, brochures, etc and the parent/student removes that consent you not only have to remove that photo from any websites, displays but also bin any brochures they are in and try and get back any that have been given out already.

 

GDPR madness if you ask me....

 

Where does it state that you have to gain consent for photos that are used for school purposes?

[Edutech98]

At the GDPR training held by our local LEA they advised that if consent for photos is asked for publicity, website, brochures, etc and the parent/student removes that consent you not only have to remove that photo from any websites, displays but also bin any brochures they are in and try and get back any that have been given out already.

 

GDPR madness if you ask me....

 

?

 

 

I disagree with this and think the local LEA have misunderstood the Article. Under the 1998 Data Protection Act, if a person withdraws consent and you no longer have a lawful bases to carry on processing the data then you should stop processing it. The advice is the same under the GDPR so schools are in the exact same position regardless of GDPR coming into play.

 

Article 17 which covers the right to be forgotten says where you have made the personal data public you are required to take reasonable measures to remove the data from the public domain. But you can take into account the cost of doing this and reasonable steps. I don’t think it’s reasonable for someone to consent, then remove their consent and expect the school to bin 100’s of brochures that have been paid for by public money.

 

In this case I think they can rely on the exemption of cost and reasonableness so they shouldn’t use the picture for future publication, but I feels its fine to use them for brochuers/magazines etc as long as you had planned. For something like a website, if its a simple as just removing the picture, then you should.

Edited May 3, 2018 by Edutech98

[MkII]

I don't think that a picture on it's own counts as sensitive data unless there's a clear cross reference to other identifying information.

[gypo]

Question - Even though we have consent for photos from Students via their admissions forms, do we need to gain consent again for GDPR?

[Meldrew]

As long as the consent on your admission form is compliant with the GDPR rules then no. If however, your consent is an opt out (for example), then you'll need to re-gain consent.

 

Meldrew