Do we need to get parent consent for a school to use Google Photos?

[TwistedHelixis]

The primary school have a bunch of Android tablets that the pupils use to take photos of their work etc. One of the teachers has asked to use Google Photos on the tablets (currently disabled in Google admin), so they can share the photos taken on the tablets with their teacher account on their laptop.

 

The pupils dont have indevidual accounts on the tablets as the tablets are all logged in as a class.

 

Does the school need to get any type of parent consent? as Google Photos comes under Google non core services.

 

Does the fact that the pupils are using a shared account make any difference to the above?

 

Also, how does Google's new 'Over 18' requiement play into all of this?

[TwistedHelixis]

Important changes to Additional Services

September 2021—Control services and features for users under 18

 

Control access to Google services by age

Starting in September, 2021, Google Workspace for Education admins can set access to some Google services based on age. If admins don’t identify users that are 18 and over:

All users in primary or secondary institutions default to under 18 and get a restricted experience in some Google services.

Users under the age of 18 also lose access to certain services.

Higher education institutions have no default age-based restrictions. However, admins in those organizations are required to identify any users under the age of 18.

Services without an On or Off control are set to Restricted for users not designated as over 18. You can’t change this setting for those users.

 

Does this mean that even if we get consent, Google photos might not work?

Edited November 20, 2021 by TwistedHelixis

[Ditto]

Fascinating question! I suspect your second post means it won't be possible anyway, but I guess if the teacher used a digital camera, they'd be nothing stopping the photos being uploaded to Google Drive, so the question remains relevant theoretically anyway. A couple of observations first. Firstly, it's good to see Google using English education terminology and not usual US K-12 wording. Second observation is, I don't think GDPR intended to get in the way, of what on the face of it, is a reasonable thing to do, but....

 

I've been having a number of discussions recently with my charitable employer that works with a lot of schools, but also the NHS. The charity always seem to look for consent, but I'm challenging that stance. In terms of lawful basis to process data, there are 6, of which consent is just one. As the ICO point out, consent isn't necessarily a better choice than any of the others. I often refer back to https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing.

 

Completing a DPIA, can help with deciding which is best for your scenario. Also, getting your DPO to review and ultimately sign-off the DPIA will leave you in a more defendable position in the case of a complaint, than not having any evidence of showing you have given it proper thought.

 

I think a key question for me is whether any of the work could be linked to an individual and also what the teacher is going to do with the images. Sharing within the class only is one thing, sharing with all parents or posting on the school website a different matter. So, as I find almost daily at the moment with DPA/GDPR matters, there are more questions to start with than answers. What is good practice though, is once you've decide your lawful basis and to what extent you are going to share the data, get your documentation, such as privacy notices etc. updated and published.

[GrumbleDook]

Google is a non-core service and so they may make use of the data for their own purposes.

So this is not so much about whether you need consent for your own processing, but what does Google need and how will that be collected/retained.

[GrumbleDook]

I’ve just spotted that autocorrect changed Google Photos to just Google in my response above … to clarify, it is Google Photos that is a non-core service … not the whole of Google!