GDPR - Managing consents

[GrumbleDook]

I think that is an issue - because there isn't any new ICO guidance on taking pictures within school.

 

What I'm trying to risk assess is, is there anything in the new DP/GDPR that could impact the currently published, but old, ICO guidance.

 

For example has the definition of public task changed that would mean the ICO would need to reconsider if the guidance under DPA 1998 is still valid under GDPR/2018.

 

The DfE guidance is great thanks for that. Quick questions ref public task. The guidance on page 23 says photographs used in identify management may be essential for performing the public task of the school.

 

I'm presuming this means ID cards, pictures within Sims etc. How does this fit in within public task? No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task.

 

A few areas to consider in this.

 

Re photos in public task for identification. Identification can mean on SIMS (important when logging behaviour incidents or needing to verify individuals at speed), on ID Cards (are they someone who is meant to be on-site?), knowing if they have particular needs (medical requirements such as needing epi-pens ... although this is processing special category personal data you still need a valid lawful basis under section 6 of GDPR ... and whilst other lawful bases are applicable too, public task is acceptable as you are already using it).

 

The definition of a public task is for core activities. In November(?) DCMS issued a letter of guidance to all departments, to the ICO and other groups, pointing out that public authorities can only use LI for non-core activities. That means schools need to look at what their core activities are as set out by legislation and statutory guidance. And there is a lot of it.

 

Marketing doesn't appear in there. I've spoken with one academy that, similar to how you have set out, that they have a responsibility to get bums on seats and keep the school funded by having a full intake. To some extent this is what the old requirement of a prospectus was for ... however ...

 

If we look at the School Prospectus, take a look at this *old* article from Modern Governor (https://www.moderngovernor.com/school-prospectus-and-publishing-school-information-on-the-internet/) showing how long ago it changed that schools don't need one but need to publish information on their website - https://www.gov.uk/guidance/what-maintained-schools-must-publish-online is the present guidance (including link to relevant act) and also links to what is needed for free schools, acedemies and colleges. In there there is no requirement to show pictures or show activities that are part of pitching the suitability of the school ... no chance to say you *have* to show that you have all the latest tech, show children having fun in your swimming pool with retractable roof or to show that you get visited by Olympians. The requirement is now to state facts to get people to look at the school ... everything else is not a requirement but ... well ... marketing. You have fulfilled your Public Task already ... you don't *need* to have lots of pics.

 

Once you have established this then it leaves you asking how you can comply with the guidance as it stands *and* also with DPA2018. By gaining consent for media and marketing at the beginning of the year use you can continue to use that basis for events and, as you describe, you give continuing notice to families as events continue ... allowing families to raise their right to object. That would indeed reduce the amount of paperwork you do as a result. The downside is that if a sizable number of families exercise this right it starts to look like you are putting an opt-out solution in place ... and as we know, opt out is a no-no. There is also the risk that some events can only be participated in if consent is agreed. I know that there have been explanations from other members that *they* would never allow it to be aused that way ... who is to say everyone in the school will continue with that. Once in place ... it is there and hard to avoid. This is one of the reasons why the law talks about consent being unambiguous and not providing it should not disadvantage the data subject. From personal experience, and from collectively talking with adoptive parents/guardians or parents who take more care over online footprints, this is a real and present issue.

 

And so the balance falls down to working out what can be a general consent and what is done on a case by case basis. For a prospectus, this is a perfect example. You gain permission from a parent / child. There is a reasonable understanding that this is a long term thing. They can't just change their mind. Effectively it becomes a stock photo ... and so some schools even consider the generation of stock photos and recompense for families ... and at that point it becomes processed under contractual obligations ... and the school has *way* more control.

 

And this is just touching on it ... and not going into some of the other areas I've raised in the various threads.

 

Of course ... if the DfE was to determine that marketing to get bums on seats was an required activity of a school, it would change things in a number of ways. You might get push back from those looking after the rights of children though.

Edited July 20, 2018 by elsiegee40

[mavhc]

Technical thoughts on tracking photos on website, are these correct assumptions?:

Can't store PII metadata on the website server, because it's not required (although that's only slightly worse than storing it in O365/GSuite/Hosted SIMS thinking about it, none of those are storing data encrypted without a key that's also on the same platform)

Therefore either:

1 need to sync with offline database

2 Or store an opaque number for each child in each photo online

 

1: Database of which pupils are in which photos, and who currently has consented. Somehow sync website photos with this database, produce report of any that aren't allowed now

Advantages: No data stored online, can also be used for offline photos, physical displays.

Disadvantages: Got to make sure every photo you use online is in the database, the sync would be tricky

 

2: Store opaque metadata in the CMS, Pupils 4982324, 29484834, 92483843 are in this photo. MIS report of who currently has consent and their opaque number, upload to CMS, plugin compares lists.

Advantages: CMS can report on which photos have no metadata yet.

Disadvantages: MIS has to add Yet Another Pupil Number. To work for offline photos would need a second system, could use the same method though

 

Thoughts, suggestions?

[jenatddm]

I think that is an issue - because there isn't any new ICO guidance on taking pictures within school.

 

What I'm trying to risk assess is, is there anything in the new DP/GDPR that could impact the currently published, but old, ICO guidance.

 

For example has the definition of public task changed that would mean the ICO would need to reconsider if the guidance under DPA 1998 is still valid under GDPR/2018.

 

The DfE guidance is great thanks for that. Quick questions ref public task. The guidance on page 23 says photographs used in identify management may be essential for performing the public task of the school.

 

I'm presuming this means ID cards, pictures within Sims etc. How does this fit in within public task? No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task.

 

 

Quite right to say >> "No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task." And this is why, while your lawful basis may be seen as part of a task a as a functional requirement not the exact thing that you are doing (safeguarding rather than 'use X photo on Y card'), there is also a Right to Object to consider, if using Public Task as its basis, which needs reflected in the DPIA and balancing test of the wants/needs of school, and risks to the child of processing the photo.

 

To-date there is often over collection and over sharing of children's data in/and across education, incl photos.

 

For example, a significant amount of photo sharing, especially with third-party apps, that is done on a very weak lawful basis that is neither lawful nor proportionate, and parents and children would have a strong right to object. Even G-Suite for education, can enable photo uploads as avatars, but then can also enable external viewing of that photo by outside parties if child posts comment on YouTube, or shares a Google doc for example. It's unnecessary.

 

It will take time for app developers to work towards data minimisation principles of the DPA 2018 and GDPR, but I'd suggest where starting new contracts now, strive towards data minimisation to save future processing headaches.

[jenatddm]

A few areas to consider in this.

 

Of course ... if the DfE was to determine that marketing to get bums on seats was an required activity of a school, it would change things in a number of ways. You might get push back from those looking after the rights of children though.

 

LOL. You might need a change of law first and that would not be push back mainly from concerns over the rights of the child, but from those concerned about the marketisation of education.

[GrumbleDook]

LOL. You might need a change of law first and that would not be push back mainly from concerns over the rights of the child, but from those concerned about the marketisation of education.

 

Marketisation of education ... you mean we don’t already have that? (something for a completely different thread!)

[GrumbleDook]

It will take time for app developers to work towards data minimisation principles of the DPA 2018 and GDPR, but I'd suggest where starting new contracts now, strive towards data minimisation to save future processing headaches.

 

And we have still to hear about where ISS fit within schools with respect to the age appropriate design code.