Student Photos in Office 365

[dsquared2]

Hi All,

 

SLT have asked for student and staff to have their school photo as their profile picture in Office 365. They want it to have a more friendly/VLE feel. I understand their point of view but using student photo does make me feel unconformable from a child protection view.

 

What do people think?

[Steve21]

It's only shown internally so shouldn't be a problem from that side.

 

We use them as helps identify students too when emailing theM

 

Steve

[jdoyle]

have students and staff given their permission (DPA/GDPR)?

[DrCheese]

We have it set that staff can view photos, students can't.

[RichB]

GDPR / Child protection - As long as the students and there parents give consent there isn't a legal issue with this! And a process to remove the pictures once the student leaves the school.

[dsquared2]

Most parents have signed a form to allow pictures to be used in public e.g the website and local newspapers. So I guess that will cover us for a internal system.

 

DrCheese - Sounds like a good idea. How have you set that up?

[MicrodigitUK]

We have it set that staff can view photos, students can't.

 

How did you do that in 0365?

[DrCheese]

We have salamander assign them a different OWA policy based on if they are staff/student - Then using the Set-OWAMailboxPolicy powershell you can disable photos on that policy

https://technet.microsoft.com/en-us/library/dd297989(v=exchg.160).aspx

[MicrodigitUK]

And that blocks it for all of O365 sharepoint and all other apps on O365?

 

I think I might have to give this a try if that is the case.

[DrCheese]

Answer to that: - It varies, annoyingly.

 

Microsoft had a bug a few years ago that it would still show photos if you went a certain way into OWA. They fixed this. Today we're getting this again, it's disabled in OWA but when you click on a users "icon" on an email, it's showing photos.

 

I'm a bit unsure how this will be dealt with post GDPR, i.e we get away with quite a lot under the "public interest" part & this is an internal system only. But if this bug was to occur after GDPR, how would we stand?