GDPR and photography by a third party

[sportymac]

I'm new to this forum and have read through many threads but can find anything relating to GDPR and photography by a third party so i'm hoping someone might be able to give me some guidance.

 

We run large scale participation events where we have a large numbers of different schools and children attending. In the past we have relied on the schools providing us consent for us to take and use any photos/videos for promotional/publicity purposes based on the consent they have received from parents. Teachers on arrival at the event will tell us if they have pupils who cannot be photographed and that pupil is then supplied with a neon wristband that they must wear at all times while participating.

 

Moving forward we are very unclear about how we now go about getting consent. Can we still rely on the schools to provide consent to us to take and use photos/videos or are we now going to have to go direct to the parents of approximately 3500/4000 pupils (4 events with approx 1000 young people at each) to give us explicit consent?

 

Also do we have to be able to identify in every picture we use who the child is so we can ensure we have their explicit consent? (this will be impossible due to the nature of the events where pupils don't wear school uniform but compete is coloured t-shirts of which many schools will wear the same colour) - if this is the case this will sound the death knell for us taking any photography of our events at all.

 

Are schools changing the way they get consent for photography/videography? and can this consent be passed on to third parties?

 

i'm really hoping someone can offer advice as we are going round in circles trying to get to the bottom of this.

 

Thanks

[djrscally]

Mm yeah, tricky one to be honest. We are definitely having to get consent in a different way now; we can no longer simply assume it unless parents object - it has to be the result of a positive action now (I.E. they have to "Tick to consent" rather than "Tick to opt out"), which is tricky enough for us.

 

I would say that this depends on your status. If you're a processor and if schools rely on parental / student consent to use photos for marketing and publicity purposes, they probably cannot pass that consent to you. If you're a controller, you might be able use the legitimate interests basis for processing to justify your use of the photos in marketing. If you're the one determining the purpose and means of processing the data (I.E. it's you organising and running the event and just inviting schools to participate and deciding to take the photos) you might well be a controller, but I'm not totally sure.

[enjay]

I don't see you would need to get consent directly, I think the schools could be relied on to relay the parents wishes themselves. It might come down to wording in the school's consent form though. Our forms say parents consent to us using the photographs in promotional material and online, but we don't say where - therefore photos on your website would be okay. If however the school specifically said the photos would be used in the newsletter and the school website, they would probably need additional consent for the photos to appear on your website.

 

Obviously, you're making money from the event as a whole but I'm assuming you're not selling the photos themselves. That might change things if a third party were making money from the photos.

 

Schools should conduct risk assessments of working with you, but if your photos don't name the students and they're not in school uniform, the potential impact from them getting out seems minimal to me.

[djrscally]

Our forms say parents consent to us using the photographs in promotional material and online, but we don't say where - therefore photos on your website would be okay.

 

I think this is a bit shaky tbh; Facebook's privacy notice says they can use your photos in promotional material, but I think people would be apoplectic if it turned out Facebook was sharing photos of you, say, drinking a bottle of coke to CocaCola™ for them to use on their own website.

[jmak]

The forms I am asked to sign when my kids take part in events organised by outside agencies (and I'd include other schools in that) almost always have a consent box for photos. The simplest solution would seem to me to be to insist that participating schools gather the consent information before they turn up.