Photo consent

[djrscally]

...again.

 

Doing this in a bit of a rush as the marketing chap is no longer with us. When we run events, the company managing the event inevitably wants to get photos of the kids for what boils down in the end to marketing purposes; they want to stick photos of the kids having fun on their social media so more school retain them to run events. Obviously we have to obtain consent for that one (even if you're of the "basically no consent needed for school photos" persuasion I can't see this one passing the bar!) but my concern is; is it necessary for the actual company to be named when gathering consent? Or can we have something along the lines of "I consent to photographs and video of my child being shared to 3rd party providers whom perform services for the school. These parties may then use the images for marketing, analysis and research purposes."

 

Replace "my child" with "me" for ages 13+

[elsiegee40]

Permission needs to be specific and informed. So if a third party organisation is taking and/or publishing the photos then the parents need to be informed and they need to give specific permission.

 

 

EDIT

 

Just checking this is marketing for the organisation rather for the school? Either way, parents need to give specific permission for the various ways/platforms the photos will be published on.

Edited October 5, 2018 by elsiegee40

[djrscally]

Permission needs to be specific and informed. So if a third party organisation is taking and/or publishing the photos then the parents need to be informed and they need to give specific permission.

 

 

EDIT

 

Just checking this is marketing for the organisation rather for the school? Either way, parents need to give specific permission for the various ways/platforms the photos will be published on.

 

Yeah marketing for the org (they couch it in nice-sounding things like "a record of the educational activity" blah blah but the long and short is they're gonna stick it on their twitter).

 

I guess we perhaps need to do a consent form for the event specifically then.

[jmak]

Supplementary query:

 

What are people doing about retaining photos for marketing purposes beyond when pupils leave?

 

Obviously for most legal bases for photos, we're not using consent and it expires when they leave. However for marketing, we're likely to want to keep them for promoting future events.

[GrumbleDook]

The school might use it for record or educational activity but you are transferring the data to a third party for them to use for their own marketing ... i.e. however they want to use it!

 

Simple answer is no, they cannot use it.

 

If they want to use it then *they* have to get consent from parents *and* children (depending on age) ... the other option is a contract to use the images and image rights of the children (which is signed by parents on behalf and possibly the child, depending on age)

 

But that isn’t your problem.

[elsiegee40]

The school might use it for record or educational activity but you are transferring the data to a third party for them to use for their own marketing ... i.e. however they want to use it!

 

Simple answer is no, they cannot use it.

 

If they want to use it then *they* have to get consent from parents *and* children (depending on age) ... the other option is a contract to use the images and image rights of the children (which is signed by parents on behalf and possibly the child, depending on age)

 

But that isn’t your problem.

I was just thinking that. If this is the third party using it for their purposes then they need to get specific permission from the kids/parents and school staff not you their client!

[djrscally]

The school might use it for record or educational activity but you are transferring the data to a third party for them to use for their own marketing ... i.e. however they want to use it!

 

Simple answer is no, they cannot use it.

 

If they want to use it then *they* have to get consent from parents *and* children (depending on age) ... the other option is a contract to use the images and image rights of the children (which is signed by parents on behalf and possibly the child, depending on age)

 

But that isn’t your problem.

 

You are pretty much spot on I think although the ICO guidance (which I've just managed to read through; as I say sort of rushing this one!!) does say:

 

Named: name your organisation and any other third party controllers who will be relying on the consent. If you are relying on consent obtained by someone else, ensure that you were specifically named in the consent request – categories of third-party organisations will not be enough to give valid consent under the GDPR.

 

So my interpretation there is that *we* can collect the consent for them, which is likely to be a precondition of their providing the service. I think that's a reasonably sound interpretation?

[elsiegee40]

You are pretty much spot on I think although the ICO guidance (which I've just managed to read through; as I say sort of rushing this one!!) does say:

 

 

 

So my interpretation there is that *we* can collect the consent for them, which is likely to be a precondition of their providing the service. I think that's a reasonably sound interpretation?

It sounds right that you can collect the permissions from them.

 

But don't forget that adults present must consent too. This isn't just about the pupils.

 

What are they going to do about the ones that don't respond and refuse permission. It could be a significant number.

[djrscally]

It sounds right that you can collect the permissions from them.

 

But don't forget that adults present must consent too. This isn't just about the pupils.

 

Yeah good point, easy to forget the adults.

 

What are they going to do about the ones that don't respond and refuse permission. It could be a significant number.

Lanyards to wear; any photo with a Lanyard in it gets destroyed.

 

The other example of use that the company gives is sharing the images with their funders (it's a non-profit) who might want to see them as evidence of the events. This again to me seems like processing they're doing for themselves rather than on our behalf, so I'd call them the controller there too.

[enjay]

If the external company take the photos on their cameras, I don't see you're the data controller at all, so consent is entirely down the company. You should check they have permissions and verify what measures they will take to identify and exclude those students who didn't consent.

 

Of course, obtaining and honouring consent yourselves might be easier!

[GrumbleDook]

It doesn’t matter who owns the equipment, the original pictures are taken under the instruction of the school ... the Data Controller.

[enjay]

It doesn’t matter who owns the equipment, the original pictures are taken under the instruction of the school ... the Data Controller.

 

With the school photographer who is taking photos because we want to upload them to SIMS, I would agree we are joint controllers. With an external company who comes in to run an event during which they take photos, I'm less sure we're joint controllers.

[GrumbleDook]

Ask yourself this ... who is deciding that the event is run? Who has the final say in what data is collected and used?

 

Unless this is a 3rd party hiring out your school to run a private function that it just happens to involve all your children ... that the school has *nothing* to do with ...

 

The school is the Data Controller. I wouldn’t even say Joint DC ... as it is not compulsory to use this particular event company, if you say no to them taking pics because you will ... I can’t see any justification for them being Joint DC.

[GrumbleDook]

The school photographer is a data processor. You are deciding what is done, not the photographer.

[enjay]

Ask yourself this ... who is deciding that the event is run? Who has the final say in what data is collected and used?

 

Fair point.