GDPR - Managing consents

[enjay]

If they leave and then object to the pic, which would be very unusual and I've never had happen

 

Unusual, but not impossible - especially if the data subject goes on to become famous, they may want greater control over their childhood photos than other people. Also, one thing GDPR is doing is introducing people to rights they never knew they had, so some people will exercise them just because they can - think about how many SARs you've had in the last two months compared to the 2 years before that!

[mavhc]

If you follow the ICO's advice you don't need to ask for a specific number of years to have the pictures on the website.

 

You just need to inform them that you'd like to put their picture up on your website. If they are happy to do so then you can keep the picture on for as long as it is still fulfilling the same purpose and not used in a way that is different to what was originally explained to the data subject. If they leave and then object to the pic, which would be very unusual and I've never had happen, then you can take reasonable steps to try and remove the pictures from archive.org etc taking into account the available technology and cost of doing so.

 

Right, but that's not the main question.

 

Don't want to be keeping all those consent forms forever after all.

 

Is anyone else archiving your website even legal?

[enjay]

Is anyone else archiving your website even legal?

 

Isn't that what Google and Cached Pages - Get the cached page of any URL are doing?

[Edutech98]

Yes not impossible, but unusual, hence the word unusual and not never The advice would still be exactly the same though, remove the picture as requested and any pictures in the public domain take reasonable steps to remove taking into consideration the available technology to do so and the cost.

[jenatddm]

What part of the law do you think has changed that would effect this? Consent is pretty much the same and public task is pretty much the same. The ICO is still saying they will take a pragmatic approach to data protection. The ICO website says although there are some subtle differences between the old and new laws the guidance is still considered useful.

 

See page 19 and page 23. GDPR and DP law is not everything, but PECR which has been the same for many years. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/702325/GDPR_Toolkit_for_Schools__1_.pdf

 

If you use a child's photo in a format considered personal data, in marketing materials including on social media and websites, without informing the parents / children and a pre-posting consent process, expect to lose if legally challenged.

[Edutech98]

See page 19 and page 23. GDPR and DP law is not everything, but PECR which has been the same for many years. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/702325/GDPR_Toolkit_for_Schools__1_.pdf

 

If you use a child's photo in a format considered personal data, in marketing materials including on social media and websites, without informing the parents / children and a pre-posting consent process, expect to lose if legally challenged.

 

Page 19 is completely different to what we are talking about - that's a contract between parties where the parent pays for holiday clubs etc. Clearly that would require consent.

 

PECR is something different - this is marketing via electronic communication. You wouldn't consult PECR when deciding what lawful bases to use to publish a picture - you would use DPA/GDPR. You use PECR to consult if you can market someone electronically.

 

If you see all of my replies, and the ICO guidance, it clearly says you must inform the parent or child the context of what the picture is being taken for - no one is disputing this?

[Edutech98]

 

Is anyone else archiving your website even legal?

 

I think they can under public interest. I can't find their privacy policy but there website seems to suggests they act in the publics interest so presuming that would be the lawful bases they use - "we provide free access to researchers, historians, scholars, the print disabled, and the general public. Our mission is to provide Universal Access to All Knowledge"

[enjay]

If you see all of my replies, and the ICO guidance, it clearly says you must inform the parent or child the context of what the picture is being taken for - no one is disputing this?

 

Agreed. I don't think anyone is disputing we need to communicate the parent/child. The question is whether we are informing them of what we've done or asking their permission for what we'd like to do.

[GrumbleDook]

Just to be clear I don't use LI for pictures, everything we do in the school we do under public task, including pictures. I was just throwing it out as an idea for someone who wanted to use an alternative to public interest such as consent - some interesting things for me to think about so thanks for the comments!

 

Appreciated

 

The ICO already recognises that schools will use public tasks as their lawful bases for anything to do with educating/protecting students. Pictures it seems is a but of a grey area, e.g do pics within the school help educate students, is an attractive website that helps a child pick their school in the public's interest etc.

 

The ICO seems to recognise this and has published their guidance some years ago called "Taking photographs in Schools". This is available here;

 

https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

 

In the guidance they specifically address taking pictures of students for "marketing purposes". They suggest to use a common sense approach. To quote "A small groups of children are photographed during a science lesson and the photo is used in the school prospectus. This will be personal data but will not breach the DPA as long as the children and/or parents are aware this is happening and the context of the picture."

 

There is no suggestion of using an alternative lawful bases, no requirement to gain consent, no opt in or granular permissions for different platforms. Just good ol' common sense.

 

If you go above and beyond this, fair enough that's not wrong, I just think its could be a bit of a waste of school resources and not required to comply with the DP laws as per current ICO guidance.

 

And this is where there is conflict on ICO guidance. This is an area where an update is needed perhaps and it even contradicts what happens when completing DPIAs. When you do your impact assessment you can look at you the purpose, where data will be used, the lawful basis and a raft of other items ... where there is are legal requirements that can affect the purpose this *has* to be taken into account and the legislation around safeguarding is part of this. At this point, most schools will struggle to do anything but opt for using consent. I'll raise to ICO again on this as it doesn't uphold the rights of the individual.

 

Whether it is a 'waste of school resrouces' is unimportant. Many feel that way about H&S, but it is there for a reason, and what might appear as common sense can sometimes be ignoring other factors as it makes it too difficult.

[GrumbleDook]

If you follow the ICO's advice you don't need to ask for a specific number of years to have the pictures on the website.

 

You just need to inform them that you'd like to put their picture up on your website. If they are happy to do so then you can keep the picture on for as long as it is still fulfilling the same purpose and not used in a way that is different to what was originally explained to the data subject. If they leave and then object to the pic, which would be very unusual and I've never had happen, then you can take reasonable steps to try and remove the pictures from archive.org etc taking into account the available technology and cost of doing so.

 

Wrong. You need to have it in your retention schedule. You also need to be able to justify continued use. Even if you tried to claim for marketing purposes ... you market against what the school does. If you have a picture of a science lesson and the currciculm changes so that lesson does not happen in that way anymore, if H&S changes what can be done, if the layout of the room changes and is no longer a true reflection of what the school looks like ... you are no longer following the original purpose.

 

Please don't say "but the ICO said" as the ICO will also say read the rest of the act.

[GrumbleDook]

I think they can under public interest. I can't find their privacy policy but there website seems to suggests they act in the publics interest so presuming that would be the lawful bases they use - "we provide free access to researchers, historians, scholars, the print disabled, and the general public. Our mission is to provide Universal Access to All Knowledge"

 

You can request that formal archives do not retain a copy of your website, you can state they can only do it for x years and you can also work with National Archives to have a public archive ... I would suggest the latter first as they truly are experts in this area.

[GrumbleDook]

Page 19 is completely different to what we are talking about - that's a contract between parties where the parent pays for holiday clubs etc. Clearly that would require consent.

 

PECR is something different - this is marketing via electronic communication. You wouldn't consult PECR when deciding what lawful bases to use to publish a picture - you would use DPA/GDPR. You use PECR to consult if you can market someone electronically.

 

If you see all of my replies, and the ICO guidance, it clearly says you must inform the parent or child the context of what the picture is being taken for - no one is disputing this?

 

Erm ... you have been talking about marketing to parents ... PECR would be an item of legislation to be taken into account when evaluating purpose and lawful basis. The data subject whose picture you used, if used for marketing (as you insist it is ok to do so without consent) would also need to know that you are following the rules with regards to where that picture may go, what context it is used for ... how are you doing that exactly?

[Edutech98]

Yes PECR would be used to determine if you can market to parents. PECR would also be taken into consideration when deciding your lawful bases under GDPPR/DPA. You wouldn't consult PECR though to determine your lawful bases, you would consult the GDPR/DPA and the recitals within it.

 

Perhaps I should have said unnecessary rather than a waste! That's in light of the current ICO guidance though, of course this may change in light of new guidance. If someone goes above and beyond the current guidance, then fair play to them.

 

The way I do it, and imo this ticks all the boxes, is I do one agreement when the child starts to ask the parent if they do not want public pictures of their child being used.

 

When we want to put a picture online, for example websites etc, if the parent isn't marked as not wanting pics being used, then we give them a courtesy call to inform them of the specifics. At this point they can decide if they are happy with it or not. We don't put the pics up until this conversation has been had.

 

This way we don't have to manage thousands of consent forms for different platforms that might not even be required.

 

 

Apologies for the "GrumbleDork" slip up I geniully thought this was your screenname until you pointed it out!!

[GrumbleDook]

Yes PECR would be used to determine if you can market to parents. PECR would also be taken into consideration when deciding your lawful bases under GDPPR/DPA. You wouldn't consult PECR though to determine your lawful bases, you would consult the GDPR/DPA and the recitals within it.

 

Perhaps I should have said unnecessary rather than a waste! That's in light of the current ICO guidance though, of course this may change in light of new guidance. If someone goes above and beyond the current guidance, then fair play to them.

 

The way I do it, and imo this ticks all the boxes, is I do one agreement when the child starts to ask the parent if they do not want public pictures of their child being used.

 

When we want to put a picture online, for example websites etc, if the parent isn't marked as not wanting pics being used, then we give them a courtesy call to inform them of the specifics. At this point they can decide if they are happy with it or not. We don't put the pics up until this conversation has been had.

 

And this is where I am trying to fathom out what on earth this discussion has been about.

If you are using the picture online to market you must either be doing it under consent or LI. Marketing is not a Public Task. You've said you are not using LI so that only leaves consent. The above statement pretty much confirms that and you appear to be recording that on block? But then you are giving them notification of individual use and allowing them to raise their right to object ... which needs to be recorded ... and as part of this you must tell them how long it will be used for, either as part of that discussion or as set out in your retention sechedule.

 

This way we don't have to manage thousands of consent forms for different platforms that might not even be required.

 

No, just several hundred ... and if done thoughtfully, it wouldn't be several thousand ... just once a year, with ad-hoc additional events for a handful of students at a time.

 

Apologies for the "GrumbleDork" slip up [emoji3] I geniully thought this was your screenname until you pointed it out!!

 

I have been called far, far worse ;-)

Edited July 20, 2018 by elsiegee40

[Edutech98]

This is where I disagree with most- I don't believe you must use consent or LI. I don't believe this because the ICO has published specific guidance on using picture for websites etc for schools. In the guidance they make no mention of using a different lawful bases - they say providing the school informs the child and/or parent what they are using the pictures for then you can publish the pictures.

 

The ICO know schools use public task. I believe if the ICO wanted schools to use a different lawful bases for putting pics on line then they would have said so in the guidance.

 

The opt out of public pictures, we do so for safe guarding not DP. When we tell the data subject we would like to use there picture, we do this for fair processing as per the ICO guidance.

 

I trust the ICO guidance. If you don't that's fine. If they produce more guidance to say that schools can't publish pictures on their website under public task then I would happily change my stance.

[Steve21]

In the guidance they make no mention of using a different lawful bases - they say providing the school informs the child and/or parent what they are using the pictures for then you can publish the pictures. .

 

Where did you get that from? Not seen anything similar to that in any of their guidance. Just curious

 

Steve

[Edutech98]

Where did you get that from? Not seen anything similar to that in any of their guidance. Just curious

 

Steve

 

They you go pal...

 

https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

[Steve21]

They you go pal...

 

https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

 

Which says the opposite to what you said unless I'm missing something. It doesn't say you can post photos without consent as it specifically says it's personal data, but it wouldn't breach if parents agreed and know where it's going etc aka consent.

 

Steve

[Edutech98]

Which says the opposite to what you said unless I'm missing something. It doesn't say you can post photos without consent as it specifically says it's personal data, but it wouldn't breach if parents agreed and know where it's going etc aka consent.

 

Steve

 

It doesn't say the parent should agree. It says they are aware that it is happening.

 

In fairness I don't actually think my approach is that different from everyone else, I just do it slightly different to save the schools time.

 

The consensus here seems to be you get your consent forms out first, split them into 7-8 different groups, get the consent forms back and then input them into some kind of system. This is before any picture is taken. When a picture then wants to be used, you consult your system. Because of how big our trust is, this would require thousands of different inputs.

 

Instead I do it the opposite way....

 

We tell the data subject or the parent that pictures will be taken as per ICO guidance. We then look at them and decide which ones to use. We then contact the parent/child and inform them as per ICO guidance. If the parents doesn't want us to use it, we won't in line with fair processing. If they do - it gets marked as applicable with the data of conversation and used.

 

This way we only have to input 100's rather than 1000's because we are not informing the child/parent until the time comes. Whether you want to call this consent, or inform, I suppose is irrelevant. The most important thing is we have complied with the ICO and the parent/child has been treated fairly.

[GrumbleDook]

I've PMed as this is boiling down to the interpretation of a piece of guidance that was published a number of years ago and has a number of areas that can be challeneged in reference to GDPR/DPA2018.

 

Until that is updated or clarficiations given (which could have wider impact on other public authorities when considering what is core / non-core) we have two positions.

 

1 - Take the existing guidance from ICO on face value and run with it (whether because it is published advice or because it is felt that the existing guidance does not require a change in approach under GDPR /DPA2018)

2 - Look at the guidance and consider the other factors that the recent change of legislation has introduced, and look at how to change as a result.

 

Both EduTech98 and I have put positions out there, so there is not much else to be covered on it right now that I can see. If people want to discuss particular aspects of point 2, then happy to ... but there is little to benefit right now on discussing the differences in positions of 1 and 2.

[Edutech98]

I've PMed as this is boiling down to the interpretation of a piece of guidance that was published a number of years ago and has a number of areas that can be challeneged in reference to GDPR/DPA2018.

 

 

2 - Look at the guidance and consider the other factors that the recent change of legislation has introduced, and look at how to change as a result.

 

If people want to discuss particular aspects of point 2, then happy to 2.

 

I'd be interested in hearing some specific points on how the new legislation could impact the current ICO guidance. I've asked our DPO team to reconsider our position in light of this thread so will be interested in getting some specific points of why the guidance may change and why we should be sceptical of using it as it is.

[jenatddm]

I'd be interested in hearing some specific points on how the new legislation could impact the current ICO guidance. I've asked our DPO team to reconsider our position in light of this thread so will be interested in getting some specific points of why the guidance may change and why we should be sceptical of using it as it is.

 

https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

is from 2014, found here >> https://ico.org.uk/your-data-matters/schools/ and the ICO notes on the page they need to update it. Look at their newer guidance, and the DfE GDPR guidance (worked on with the ICO) p 23 which is explicit you need consent for photos online / or media / or marketing -- you can certainly get that en bloc, once a year for example but remember that it can be withdrawn at any time. Health data collection and any biometrics also need explicit, freely gven consent and must be possible to decline without detriment.

 

(For wider ref) Photos online are not LI or public task -- (public task after all is reasonably narrow, not 'because your school thinks/ finds it necessary' but *required* by your statutory obligations as a school. No school *must* put children's photos online). And LI and PT both carry a right to object, which is then a balancing test and needs well documented to stand up. Every use of data and transfers to third parties, needs communicated up front, but up front need not mean immediately before-hand. If you have collected in advance and the purpose and distribution is unchanged it remains valid. Basically, as long as they would expect it, and aligned with what they already agreed to, your existing consent is OK. But it can't mix variety of purposes under a single 'consent banner, the 'required by school for safeguarding' versus 'to put on our website', for example -- which is conflating the lawful basis and uses.

[Edutech98]

I think that is an issue - because there isn't any new ICO guidance on taking pictures within school.

 

What I'm trying to risk assess is, is there anything in the new DP/GDPR that could impact the currently published, but old, ICO guidance.

 

For example has the definition of public task changed that would mean the ICO would need to reconsider if the guidance under DPA 1998 is still valid under GDPR/2018.

 

The DfE guidance is great thanks for that. Quick questions ref public task. The guidance on page 23 says photographs used in identify management may be essential for performing the public task of the school.

 

I'm presuming this means ID cards, pictures within Sims etc. How does this fit in within public task? No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task.

 

[enjay]

Quick questions ref public task. The guidance on page 23 says photographs used in identify management may be essential for performing the public task of the school.

 

I'm presuming this means ID cards, pictures within Sims etc. How does this fit in within public task? No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task.

 

My take on that is we need photos of the students so we can identify them. This might be about cover teachers accurately identifying a child for registration or safeguarding reasons, staff identifying a student they don't teach but need to record a behaviour incident for (or worse, report a safeguarding concern due to an overheard conversation) or a first aider being able to identify a student with a particular condition.

 

Also, ironically, useful on the "do not photograph" list! The person who does our newsletter and website has a printed sheet of the students on the list, so they can double-check photos are okay before publishing.

[mavhc]

You NEED photos for identification, security, registration -- So you don't need approval I guess

You WANT photos for documenting school work -- You need approval for this

You LIKE photos for marketing, making people feel good by showing achievement, etc -- You need another level of approval for this

 

reminds me of What Colour are your bits? - Ansuz - mskala's home page