Parental Consent

[JordanT91]

We've got a consent form that parents must sign with a few categories on, some of which are relevant to data protection. It goes out as part of the admission pack. The relevant categories are:

 

I give permission for my child to be photographed or filmed for use on the schools website (which may occasionally be included on school Facebook timeline).

I consent to my child’s image and/or work to appear on the school VLE (online learning area, accessed by password issued from school) and include their first name.

I consent to my child’s image being used by in school documentation (e.g. school prospectus) and by outside bodies/agencies working with pupils in school.

I give permission for my child to be photographed or filmed by or for the media (press/television) and for my child’s name to be released for publication either as an individual or part of a group.

 

and then a separate form for Tapestry:

 

I give consent for my child to appear on individual photos visible to your child's designated parent account and staff.

I give consent for my child to appear on group photos and observations that will be viewed by other parents of pupils in the class.

 

I was reading how consent should be opt-in, which I believe it is, but also granular. I've come up with the following categories for a new permission form:

 

Prospectus/other marketing materials such as promotional photos and videos for the school and charity

Reports to governors (which will be uploaded to the website)

Website

Facebook

VLE (visible to other parents but not the public)

Media

Photos in 'public' areas of the school, such as on the Reception display screen and corridor photos

Photos in classrooms

Tapestry - individual

Tapestry - group

 

 

Am I missing anything?

[Edutech98]

Imo I don't think any of this is necessary and causes extra work that you don't need to do.

 

The ICO guidance on photographs taken in school says to take a common sense approach, and if the photographer/teacher asks for permission to take a photograph that will be enough for compliance. It doesn't seem you need a granule permissions for every student and every eventuality of picture.

 

To cover save guarding, and fair processing, in addition to this I recommend to my schools using one opt-in for pictures to be taken that could be used publicly, i.e website, prospectus etc. This isn't gaining consent in the DP term, it is mainly to cover safe guarding.

 

If you wanted to attach a lawful bases for your own documentation I would personally use these;

 

School Website - legitimate interest

SChool image/work - if this is connected to the students work public task

outside bodies/agencies - public task

school prospectus - ICO guidance says as long as the child and/or parent is informed then this will not breach the act

Media - covered by journalist exemption - providing the child and/or parent is informed

Tapestry - If this is connected to the curriculum then public task

Reports to governors - public task

photos in classrooms - public task

photos in public area - either legit interest or public tasks

Edited July 18, 2018 by Edutech98

[enjay]

I was reading how consent should be opt-in, which I believe it is, but also granular. I've come up with the following categories for a new permission form:

 

Prospectus/other marketing materials such as promotional photos and videos for the school and charity

Reports to governors (which will be uploaded to the website)

Website

Facebook

VLE (visible to other parents but not the public)

Media

Photos in 'public' areas of the school, such as on the Reception display screen and corridor photos

Photos in classrooms

Tapestry - individual

Tapestry - group

 

 

Am I missing anything?

 

I'd go generic, and say "online including social media", otherwise you will need to re-obtain consent when someone decides Twitter is worth doing alongside Facebook.

 

Also, I would make it a single opt-in to all those uses, rather than giving/declining consent for each media. Others on here disagree with me on that though.

 

As for "public areas" versus classrooms, I suspect your classrooms are public areas. Visitors getting shown around the school may be shown inside classrooms, parent consultations may happen in classrooms, one-off visitors such as trainers or salespeople may be met in a teacher's classroom, contractors will work in classrooms, and so on.

[GrumbleDook]

Imo I don't think any of this is necessary and causes extra work that you don't need to do.

 

The ICO guidance on photographs taken in school says to take a common sense approach, and if the photographer/teacher asks for permission to take a photograph that will be enough for compliance. It doesn't seem you need a granule permissions for every student and every eventuality of picture.

 

To cover save guarding, and fair processing, in addition to this I recommend to my schools using one opt-in for pictures to be taken that could be used publicly, i.e website, prospectus etc. This isn't gaining consent in the DP term, it is mainly to cover safe guarding.

 

If you wanted to attach a lawful bases for your own documentation I would personally use these;

 

School Website - legitimate interest

SChool image/work - if this is connected to the students work public task

outside bodies/agencies - public task

school prospectus - ICO guidance says as long as the child and/or parent is informed then this will not breach the act

Media - covered by journalist exemption - providing the child and/or parent is informed

Tapestry - If this is connected to the curriculum then public task

Reports to governors - public task

photos in classrooms - public task

photos in public area - either legit interest or public tasks

 

Please don't presume media is exempt ... you require consent on this otherwise you affect LAC / former LAC / where court orders apply / a range of other personal circumstances

As discussed on the other thread, you should not use LI for a core activity or where consent is the appropriate lawful basis. Publishing pictures of activities to the public is not a public task, strange as it may sound when first thinking about it … public task refers to the delivery of education / curriculum / care of the child and others at the school.

School prospectus - please link to ICO guidance on this as it contradicts advice I have had (cinconsistencies do exist with guidance and contextual conversations within ICO ... which is how they improve their guidance)

[GrumbleDook]

I'd go generic, and say "online including social media", otherwise you will need to re-obtain consent when someone decides Twitter is worth doing alongside Facebook.

 

Also, I would make it a single opt-in to all those uses, rather than giving/declining consent for each media. Others on here disagree with me on that though.

 

As for "public areas" versus classrooms, I suspect your classrooms are public areas. Visitors getting shown around the school may be shown inside classrooms, parent consultations may happen in classrooms, one-off visitors such as trainers or salespeople may be met in a teacher's classroom, contractors will work in classrooms, and so on.

 

Classrooms, they can be public areas but are generally controlled access. Where they are used for public activities (e.g. they are hired out) then they should be treated as public areas ... this can be managed though by having pictures in places that can be covered up, locked away, etc. It just depends on your school and the situation. Anyone would think that this is why people keep saying that data protection is about risk assessment.

 

And yes, I heartily disagree about bundling all web and social media in together ... and again it is about risk.

For some families, the risk where the picture is on the school website is small ... it can increase on twitter ... but can become high on Facebook. This is the data protection and safeguarding element of the argument.

Because there are different levels of risk that *should* be treated separately.

 

However, where some schools tie in all their social media together ... a news item on the website is automatically fed to facebook, which subsequently sends out a tweet ... then the risk is a single one across the park (i.e. high for affected families) and so only one box for consent is needed

 

And yes ... I disagree with schools who approach it this way as it does disadvantage some children ... that is an education arguement though, not a data protection one.

[Edutech98]

I agree you shouldn't presume media is exempt, but this is to do with safe guarding and not data protection. The ICO guidance says "photograph is taken by a local newspaper of a school awards ceremony. As long as the school has agreed to this, and the children and/or their guardians are aware that photographs of those attending the ceremony may appear in the newspaper, this will not breach the DPA"

 

I've linked to the ICO guidance in the other thread where they make it clear that putting pictures in a prospectus will not breach DP laws providing the person is aware it is happening.

 

Covering up pictures in a school seems like a bit pointless and is verging on paranoia imo. What risk could this possibly bring? There are people that walk past children going into the school on a daily bases, we don't ask them to blindfold themselves so they can't see the pupils.

 

As per the other thread, a granular approach doesn't seem like common sense which is the advice the ICO has given to schools ref pictures. Our schools would end up with thousands of individual consents for separate platforms - this would just not be workable. A single form stating you can or cannot publish pictures that may be seen by the public is enough imo for safe guarding and is workable. If a specific parent wants more granular control then deal with this as a ad hoc requirement.

[GrumbleDook]

I agree you shouldn't presume media is exempt, but this is to do with safe guarding and not data protection. The ICO guidance says "photograph is taken by a local newspaper of a school awards ceremony. As long as the school has agreed to this, and the children and/or their guardians are aware that photographs of those attending the ceremony may appear in the newspaper, this will not breach the DPA"

 

The context is that this is done with the family / child having given consent to this use and are being notified that it is done.

 

I've linked to the ICO guidance in the other thread where they make it clear that putting pictures in a prospectus will not breach DP laws providing the person is aware it is happening.

 

Responded to in the other thread. Please remember that other legislation has an impact when doing your impact assessment of this.

 

Covering up pictures in a school seems like a bit pointless and is verging on paranoia imo. What risk could this possibly bring? There are people that walk past children going into the school on a daily bases, we don't ask them to blindfold themselves so they can't see the pupils.

 

Please understand that some pictures used in the day time during lessons (behaviour charts, birthday charts) are items that may have risks associated with them, depending on what else the school uses that classroom for, who can see in etc. It is a risk-based approach.

 

As per the other thread, a granular approach doesn't seem like common sense which is the advice the ICO has given to schools ref pictures. Our schools would end up with thousands of individual consents for separate platforms - this would just not be workable. A single form stating you can or cannot publish pictures that may be seen by the public is enough imo for safe guarding and is workable. If a specific parent wants more granular control then deal with this as a ad hoc requirement.

 

Saying that parents can request it ad-hoc means you are enforcing opt-out ... this is not legal.

And as for thousands of records ... wow, imagine that ... a school having to manage lots of bits of information about individuals, like name, address, medical information, behaviour, friendship groups, attendance, permission to attend and take part in activities ... Anyone would think there are solutions out there that can help with this?

 

Difficult does not mean you should avoid things.

 

I really do think you are missing that fact that this is a risk-based approach and that guidance should not be taken in a silo but understand as part of the wider picture.

 

An open question to you now ... have you taken all of this to your DPO or is this from your DPO?

[Edutech98]

I agree you should take other pieces of legislation into consideration, which the ICO guidance has done, and which all schools should do.

 

I think behavioural charts and pictures of students are very different. I agree some items shouldn't be on display to the public. To say you must cover up all pictures which your initial comment suggested is different than pointing out some items, such as behaviour charts, should have a higher level of security attached to them.

 

It was the other way around, our DPO put the suggestion to me on how the procedure should be (as set out in the other threat). I'm the head of risk and policy for the LA that the school contract to. I agreed with their proposition and still do.