Photo Consent

[Gongalong]

Hi folks,

 

We have always followed County advice (predating GDPR) and sought explicit consent to use student photos on the website, social media etc. I was surprised to spot in a privacy notice for another school that it considers this usage as Legitimate Interests, although they do explain that consent can be withdrawn https://www.bancrofts.org/wp-content/uploads/2018/05/GDPR-Pupil-Privacy-Notice.pdf. It does get around the whole issue of trying to identify students in photos, which is very time consuming.

 

What do others think of this, fair to use Legitimate Interests, or to seek explicit consent?

 

Thanks

[GrumbleDook]

Hmmm .... Legitimate Interests in Public Authorities cannot be used for Core Purposes.

 

If they are publishing on websites and social media they will have 2 purposes ... informing parents of educational activities (Core Purpose) and marketing to encourage applications to the school, promoting to try to gain additional funds, etc. (LI).

 

However, the risk that could exist to children when you take into account that the school is establishing a digital footprint on an opt out basis instead of using explicit consent would be high ... and they should be showing they have tried to do everything to reduce the risk ... and a perfect and well established way would be to use Consent, preferably at a granular level.

 

If it has been done that way to reduce the administrative burden rather than uphold the right of the data subjects ... then it is a no no!

 

Ask to see their DPIA on it ... if they can’t give you one (which they should under FOI) then that probably answers you question.

[Gongalong]

The linked privacy notice comes from a private school, so that eliminates the public authority bit for them. We're a state school though, so it doesn't eliminate it for us.

 

I don't see a great risk in publishing photos of students, as long as names aren't used - we have a policy that governs use of images and how they are published, and what consents need to be gained. This is where I think the requirement for explicit consent is over the top, although of course parents/carers can always withdraw consent.

 

Curious to see what other schools in practice though. I'll create a poll...

[GrumbleDook]

Really does depend on the catchment of the school and the risks involved ... the digital footprint is an important factor as the school needs to establish where the right to erasure comes into play ... can they balance LI against not being able to claw back images when the child is old enough to make that request themselves?

 

Opt out is really not an option ... or if that is what they are relying on then they may have a lot of additional items in the contract with parents.