GDPR - Managing consents

[GrumbleDook]

Photos, on websites, minibuses, around school.

 

1. Should they be removed as soon as the student has left school?

2. What about students who left 5 years ago? Does all of this apply?

3. What if the pupil and parents disagree with each other, only allow photos if all of them agree?

4. If they ask for photos to be removed, do they have to specify which, or just say "on the website"?

5. How are you tracking who's in what photo, so you can remove them when asked? Tagging on the CMS? Keeping a spreadsheet list somewhere? Another database?

 

Generally it would be as per your retention schedule and as per the retention period specified on the relevant consent form.

For students who have left ... if you don't still have a relevant consent form then get the pictures off straight away!

For student who are leaving ... it depends on what was on any cosent form ... and this is another push for granularity here.

If they say "remove my photo" then they mean all of them unless they are obviously being specific ... also remember that you have a duty to uphold their data rights and are a public authority. Be helpful and ask them the question of which photos ... there are two reasons for this. If you are trying to trick them to save work then it will be both publicly bad for the school and a dim view will probably be taken by ICO. Secondly ... if you are not helpful you are going to end up with them asking where all their photos are ... and that is a SAR ... so more paperwork!

And managing assets ... yes, managing pics will be a pain in the backside. Let me know if you ever find a good solution!

[Edutech98]

For students who have left ... if you don't still have a relevant consent form then get the pictures off straight away!

!

 

I'm still not sure I agree with this. Pictures in the school would surely be public task that is used and not consent? Photos external on websites etc would be legitimate interest. Otherwise the school is in a position where they would need to manage thousands of consent forms.

[GrumbleDook]

I'm still not sure I agree with this. Pictures in the school would surely be public task that is used and not consent? Photos external on websites etc would be legitimate interest. Otherwise the school is in a position where they would need to manage thousands of consent forms.

Photos on the website require consent though I would be interested to hear why you think they would be Legitimate Interest. Photos around the school could onlybe used for public task if was being used for the education of that data subject, or whilst they were there ... what benefit is there to the data subject in it continuing to be used once they have left?

[Edutech98]

For photo's on the website - the school has a legitimate interest in attracting students and parents to the website. They do so by incorporating pictures into the design of the website, so it looks slicker / more appealing / more interesting to its users.

 

They need to balance the legitimate interest against the risks to the data subject. I would argue that the risks are on the very low side. To mitigate the already low risks, the school can inform the students/parents that they intend to use a picture with them in it. The child/parent has an opportunity to stop this if they want. If they do, in light of fair processing and safe guarding, the school should not use the picture.

 

If they don't object, then the school has weighted their interests against the risk and I would argue it weights in the schools favour as there are no longer any reasonable risks.

 

For photo's around the school this is my rationale - The school has a public task set out to educate children. They have different strategies for doing this, including motivating students, inspiring them, making the school an attractive place, making them feel part of the school etc.

 

Putting pics up of a children can and does motivate, inspire and include them - which helps educate the children. The ICO has already accepted in guidance how much pleasure pictures of children in a school can bring.

 

To use public task the data processing has to be neccessary. The ICO define necessary as "a targeted and proportionate way of achieving your purpose".

 

I would argue that motiving children, by putting pictures up of them, is proportionate when you take into account the benefits vs the almost zero risks of putting up a picture in a school of a child. Similar they inspire other students with almost zero risk.

 

Using consent adds a whole world of trouble - you could have 1000's of individual consent forms, you need to have opt in, you need to be able to identify students in pictures, you need a way of removing pictures etc. All this seems a lot of work, especially in light of the ICO saying school should take a common sense approach and just asking for permissions before a photo is taken is enough to comply with DP laws.

[localzuk]

For photo's on the website - the school has a legitimate interest in attracting students and parents to the website. They do so by incorporating pictures into the design of the website, so it looks slicker / more appealing / more interesting to its users.

They need to balance the legitimate interest against the risks to the data subject. I would argue that the risks are on the very low side. To mitigate the already low risks, the school can inform the students/parents that they intend to use a picture with them in it. The child/parent has an opportunity to stop this if they want. If they do, in light of fair processing and safe guarding, the school should not use the picture.

 

I think you're approaching it from the wrong angle - the data belongs to the data subject - it is up to you as a school to show you have a right to use it, not for the person to say they *don't* want it used. That's the exact opposite of what the law says (consent is explicit opt in, not opt out). Your interpretation would mean that any company could justify the use of a photo of someone without their permission, as it is advantageous to the company. You have to ask the question "how does this benefit the data subject" as well.

 

Photo use for websites and internal display purposes is most definitely a consent based use. I don't think I've seen anyone challenge this idea before, even under the old DPA.

[Edutech98]

I. That's the exact opposite of what the law says (consent is explicit opt in, not opt out). Your interpretation would mean that any company could justify the use of a photo of someone without their permission, as it is .

 

.

 

The law doesn't say you have to use consent, there are other lawful bases. A company can use your photo without your permissions, for example CCTV images used at a football match to identify barred customers. I'm saying the school does have a right to use the image - they have a lawful bases of public interest. They believe that publishing pictures within the school, amongst other things, motivates the data subject. It also motivates other students, whether through inspiration or making the school look better.

 

In the interest of fair processing and being transparent, the school should ask for permission, but this doesn't mean you are using consent. You can ask for permission and still use the lawful bases of a contract for example. The ICO guidance of using pictures in a school doesn't say you need to use consent, it just says to use a common sense approach.

[localzuk]

The law doesn't say you have to use consent, there are other lawful bases. A company can use your photo without your permissions, for example CCTV images used at a football match to identify barred customers. I'm saying the school does have a right to use the image - they have a lawful bases of public interest. They believe that publishing pictures within the school, amongst other things, motivates the data subject. It also motivates other students, whether through inspiration or making the school look better.

 

I can just about see the argument for use internally, but cannot for a website. The ICO says that "Public Task" can be used as a lawful basis if you process data:

 

 

• ‘in the exercise of official authority’. This covers public functions and powers that are set out in law; or
  
• to perform a specific task in the public interest that is set out in law.
  
• & The processing must be necessary.
  

We don't have an legal requirement to have children's photos on our websites, and having a child's photo on a website isn't really a specific task in the public interest.

[Edutech98]

My post suggested to use legitimate interest for photo's on a school website, rather than consent. The school would need to do the legitimate interest balancing test first, but would be much easy for the school than consent.

[localzuk]

My post suggested to use legitimate interest for photo's on a school website, rather than consent. The school would need to do the legitimate interest balancing test first, but would be much easy for the school than consent.

 

OK then. I would say it would always fail one of the 3 tests you should do then, as with the public task interest, it fails on necessity. - https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/

 

It is not a necessity to include children from our schools on our websites. Other alternatives are available - photos of facilities, stock photos, photos of work etc...

[Edutech98]

OK then. I would say it would always fail one of the 3 tests you should do then, as with the public task interest, it fails on necessity. - https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/

 

It is not a necessity to include children from our schools on our websites. Other alternatives are available - photos of facilities, stock photos, photos of work etc...

 

Necessity doesn't have to mean it is absolutely essential. Necessity, as defined by the ICO, means "targeted and proportionate way of achieving your purpose". To determine if something is proportionate we have to balance the risk to the data subject Vs what we are trying to achieve. The risks to the data subject are embarrassment and safe guarding. We mitigate these by telling the data subject that we would like to use their picture. If they refuse, we couldn't put it up as it wouldn't pass the fairness test.

 

The benefits are a nicer looking website, motivated data subject, inspired student, happy parents/grandparents etc. So you've got lots of benefits vs a risk that has been mitigated. I would argue this makes it a proportionate approach to take and is in line with the ICOs common sense approach.

[localzuk]

Necessity doesn't have to mean it is absolutely essential. Necessity, as defined by the ICO, means "targeted and proportionate way of achieving your purpose". To determine if something is proportionate we have to balance the risk to the data subject Vs what we are trying to achieve. The risks to the data subject are embarrassment and safe guarding. We mitigate these by telling the data subject that we would like to use their picture. If they refuse, we couldn't put it up as it wouldn't pass the fairness test.

 

You are merging the necessity test with the balancing test there. They are realistically 2 separate things, and I would say your use of someone's photo on a website is not targeted or proportionate. You are using it to advertise, and you do not have to specifically use that person's image to do so. So, it is not "targeted". Unless you are saying that there's no other way of achieving this goal that doesn't use that individual person's photo? Data usage isn't just about risk, it is about whether you simply have the right to use that data for that purpose in the first place. You are jumping ahead by bringing risk into the decision making process.

 

As the ICO says, you break it down as:

 

This can be broken down into a three-part test:

 

1. Purpose test: are you pursuing a legitimate interest?
   
2. Necessity test: is the processing necessary for that purpose?
   
3. Balancing test: do the individual’s interests override the legitimate interest?
   

1. This can be argued, sure

2. I cannot see how this can be argued, as there is not a necessity to use the image of a specific child.

3. We haven't hit this test yet.

 

Your argument also ignores the fact that we are supposed to be extra careful when its a child, per:

 

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

 

The other aspect is this - if you are putting files on a website in order to further behaviour purposes etc... then I would ask the question "why does this need to be a public website?" The general public do not need to see that child on that website. You can achieve the same result with a targeted newsletter - sent to parents of the children at the school. From the ICO "You cannot rely on legitimate interests if there is another reasonable and less intrusive way to achieve the same result."

 

Finally, I would question your earlier argument that consent is hard for schools to manage. We've been doing it for years. We send out consent forms for every school trip. We send out a data checking sheet each year, and include a consent form that lists the various general consents we would like, and these get put into SIMS. Managing consent is what we do every day in schools.

[DJ-1701]

If I was a betting man, I would put money on @localzuk being right here. In either case, one should always err on the side of caution.

[Bigbird7]

If I was a betting man, I would put money on @localzuk being right here. In either case, one should always err on the side of caution.

 

Odds on favourite in my view too

[rom1984]

I'm not sure how I'm merging the necessity test with the balancing test? Could you elaborate?

 

The necessity test means is something targeted and proportionate.

 

To test if something is proportionate, you need to balance risk vs benefit. Out of interest how do you measure if something is proportionate or not?

 

You are suggesting that you can't use the person's image because you do not specifically need to do so - this isn't what necessity means for DP.

 

imo;

Purpose Test = We agree

Necessity Test = The data is proportionate to the risks (this is how the ICO says it tests necessity. We shouldn't use our own test for necessity, we should use the regulators)

Balancing Test = very little risk with lots of rewards

 

I agree with should handle children data being extra carefull. I'm not sure what the risks are of putting a picture online that the parent and child knows about?

 

Grumbledork - someone who works in DP, has said managing pics will be a pain in the backside. There is another thread on here that was looking at getting consent that would run into thousands of separate pieces of consent if done at my trust. All this despite the fact the ICO has specifically said look just use a bit of common sense, let the person know what you are doing and you won't be in breach of DP laws.

[GrumbleDook]

Grumbledork

I love this ;-)

- someone who works in DP, has said managing pics will be a pain in the backside. There is another thread on here that was looking at getting consent that would run into thousands of separate pieces of consent if done at my trust. All this despite the fact the ICO has specifically said look just use a bit of common sense, let the person know what you are doing and you won't be in breach of DP laws.

 

I'll talk about managing consent in a bit ... it is a pain ... when not done properly and without due consideration. It is also worth saying that a little pain up front is worth it to save a monumental hurt (to the child, the school or both) later on.

[BFCIT]

Just to add my two penneth worth...

 

We as a school ask for explicit consent for student photos on our website, social media outlets etc, anything in the public domain essentially. Like localzuk my opinion is that we cannot rely on any other GDPR lawful bases other than consent for publishing a student photo. In the school building however we feel that for display boards and other necessary purposes, we can in fact rely on the public task legal bases to put photos up of students. We have taken the safer approach of telling staff to use 'first names' only in school and on any online platform. We have found that the public domain vs internal school analogy makes it in our opinion easier for our support and teaching staff to understand.

 

If we ever wish to publish full names alongside photos/videos/classwork etc on social media or the website for a national achievement etc - we will go out and seek specific consent at the time.

 

There are risks attached to putting student photos on a school website including parental problems, looked after children etc, who may need protecting and therefore their affiliation with a school needs to be kept confidential.

[GrumbleDook]

@localzuk has captured pretty much everything … anyone would think that this is a discussion that has been going on for over 10 years now and he's read pretty much the same things I have and he is spot on with the tests ... necessity is the key one.

 

@Edutech98 you have understandably, and possibly justifiably, argued that as a marketing tool there is a legitimate interest in using pictures of real children from the school doing things they will learn and experience at the schools ... and whilst LI is understandable you have to think which is the most appropriate lawful basis where multiple may apply. It boils down to the balance between LI and Consent.

 

If you go down the consent route there is a fair balance of families and children that will be happy with this (I'll discuss the time periods separately) as it not only celebrates the activities of the school, it celebrates the activities of the children involved ... and whilst the use of this within a school environment can fall under Public Task, use on the website and social media would not ... hence consent.

 

If you look at legitimate interest, then there will still be a fair balance of familes and students happy to promote the school (i.e marketing) as LI can be used as it is not a core function of the school ... but celebrating the activities of the child *is* a core function (as established as Public Task for use within school) and so LI *cannot* be used. So it boils down that this is purely for marketing. It is not a nessity for the school to use pictures of attending children doing real activities. It will fail as there are plenty of alternatives to this.

 

Now, lets get onto the time periods on this.

 

Again, we are looking at what is truly required and is it appropriate. If we are using Consent (which I think we have established is the applicable lawful basis) then we go back to the above 2 reasons for use of the pictures ... celebrating the school and celebrating the children.

If the child is no longer at the school is it a requirement to celebrate them? Perhaps ... but not forever ... maybe for up to 1 academic year after they left? That would cover promoting success in the summer cricket tournaments during November ... when Cricket season comes round again, surely those pics would be replaced by new successes?

Celebrating the school? Do you have to use those particular pictures? No ... not unless there is a particular outstanding achievement perhaps ... and in which case you can ask for specific consent from the family in the same way news outlets do ... to use and re-use the pic for x years ... up until the poin it is moved across to a public archive. And managing a Public Archive in school should not be attempted if the school is trying to use it as a way of keeping things to be used forever ... go and have a chat to the education team at the National Archives for guidance on that ... that is *very* special and you need to speak with archivists to truly understand it!

 

So we come back to the idea of using LI. It fails on several attempts. If you try to use it then prepare to be challenged.

Edited July 19, 2018 by GrumbleDook

[GrumbleDook]

The law doesn't say you have to use consent, there are other lawful bases. A company can use your photo without your permissions, for example CCTV images used at a football match to identify barred customers. I'm saying the school does have a right to use the image - they have a lawful bases of public interest. They believe that publishing pictures within the school, amongst other things, motivates the data subject. It also motivates other students, whether through inspiration or making the school look better.

 

In the interest of fair processing and being transparent, the school should ask for permission, but this doesn't mean you are using consent. You can ask for permission and still use the lawful bases of a contract for example. The ICO guidance of using pictures in a school doesn't say you need to use consent, it just says to use a common sense approach.

 

Some of this you are confusing the right to be informed where the lawful basis is public task or legal obligation ("We are using your picture to identify if you are a hooligan") and consent to process ("Can we use your picture to take a register in an automated fashion?")

 

Permission implies a reference to consent ... it is very hard to separate the two terms out. At the DfE hackday looking at retention and purposes we discussed consent forms for educational activities, and it got confusing. Even after we decided that we would call them permission slips (attendance on education trips in England does not require specific as there is statutory guidance on this from 2014, so processing any data related to this does not require consent either, it is a public task) it was still felt that it was very close in terms ... but saying "information notice to parents that also gives them a form to object to taking part in an educational activity that children could normally go on" is a bit of a mouthful ... so the common sense approach is use careful language but try to be clear and transparent.

 

When you are clearly talking about permission to do something ... you are talking about consent. Where that permission is related to data you are talking about the lawful basis of Consent.

Edited July 19, 2018 by GrumbleDook

[Edutech98]

Just to be clear I don't use LI for pictures, everything we do in the school we do under public task, including pictures. I was just throwing it out as an idea for someone who wanted to use an alternative to public interest such as consent - some interesting things for me to think about so thanks for the comments!

 

The ICO already recognises that schools will use public tasks as their lawful bases for anything to do with educating/protecting students. Pictures it seems is a but of a grey area, e.g do pics within the school help educate students, is an attractive website that helps a child pick their school in the public's interest etc.

 

The ICO seems to recognise this and has published their guidance some years ago called "Taking photographs in Schools". This is available here;

 

https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

 

In the guidance they specifically address taking pictures of students for "marketing purposes". They suggest to use a common sense approach. To quote "A small groups of children are photographed during a science lesson and the photo is used in the school prospectus. This will be personal data but will not breach the DPA as long as the children and/or parents are aware this is happening and the context of the picture."

 

There is no suggestion of using an alternative lawful bases, no requirement to gain consent, no opt in or granular permissions for different platforms. Just good ol' common sense.

 

If you go above and beyond this, fair enough that's not wrong, I just think its could be a bit of a waste of school resources and not required to comply with the DP laws as per current ICO guidance.

[localzuk]

@Edutech98 - that is referring to the old Act, and the law has been tightened up with GDPR, so I don't think you should be referring back to that in this case.

 

As I stated earlier, schools do not have a legislated reason to have photographs on their public facing website, so having photos of children on a website is therefore not a Public Task.

[Edutech98]

What part of the law do you think has changed that would effect this? Consent is pretty much the same and public task is pretty much the same. The ICO is still saying they will take a pragmatic approach to data protection. The ICO website says although there are some subtle differences between the old and new laws the guidance is still considered useful.

[localzuk]

What part of the law do you think has changed that would effect this? Consent is pretty much the same and public task is pretty much the same. The ICO is still saying they will take a pragmatic approach to data protection. The ICO website says although there are some subtle differences between the old and new laws the guidance is still considered useful.

That document talks about children/parents being aware - this would indicate that those children/parents could therefore object (else why would they need to be aware?). The difference now is you need to ensure explicit consent, rather than simply allowing someone to object after making them aware. It still indicates that the reasoning for use of the photos would be consent though, and not public task.

[Edutech98]

This is what the Old DPA Act said about consent;

 

“any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”

 

and

 

“the data subject has unambiguously given his consent”

 

 

Consent could never be inferred, it could never be implied, badly written opt-out buried it terms and conditions was never consent. This is still the same - just now the GDPR stresses this because of how badly the old DPA was abused by people making words up like "oh this is inferred consent that I'm using". This was never consent.

 

They can object becuase as per the ICO's common sense approach, this is a fair approach.

 

If the guidance wanted to say you needed consent- it would say "for schools to use pictures in a prospectues you need a different lawful bases other than public task". But it doesn't say this - it says as long as you inform the subject what you are doing and what the pics will be used for then you will not breach DP law.

Edited July 20, 2018 by Edutech98

[mavhc]

1. Get consent for putting photos on website for 5 years

2. archive.org, google etc take a copy of all those photos

3. 5 years are up, who has to ask all those copiers to remove their copies of the photos?

[Edutech98]

1. Get consent for putting photos on website for 5 years

2. archive.org, google etc take a copy of all those photos

3. 5 years are up, who has to ask all those copiers to remove their copies of the photos?

 

If you follow the ICO's advice you don't need to ask for a specific number of years to have the pictures on the website.

 

You just need to inform them that you'd like to put their picture up on your website. If they are happy to do so then you can keep the picture on for as long as it is still fulfilling the same purpose and not used in a way that is different to what was originally explained to the data subject. If they leave and then object to the pic, which would be very unusual and I've never had happen, then you can take reasonable steps to try and remove the pictures from archive.org etc taking into account the available technology and cost of doing so.