GDPR and sharing images

[LPPreschool]

Good afternoon

 

I work for a pre-school and we're about to have a website built. As I understand it, we have a data controller as well as permission from parents to use pictures of the children. I assume we're ok to pass those photographs on to a web developer to use those images on the website?

 

Thanks

Tom

[jmak]

So there are a few things you need to have in place.

 

Your organisation will (must in this case) remain the data controller. That means it's responsible for taking care that it's looked after. You will be passing it to a data processor, who is only permitted to use it for the purposes you set out, not for their purposes.

 

Before you allow anyone else to process your data, you need to do a risk assessment which will feed into a Data Protection Impact Assessment. If you search around in this forum you'll find lots of helpful information about DPIAs.

 

It can all sound quite daunting and you do have to get it right, but my take is that if you think about how you would want your data to be looked after and follow it through logically you'll be well on the way.

 

It boils down to specifying where the data will be held, what it can be used for, and who can have access it to it and bring able to demonstrate that everyone has controlled all of that adequately.

[AndyCrow]

I would also add that you should make sure have explicit consent for the use of the pictures on the website.

Some parents may be happy for pictures of their children to be around the school for example, but not happy for them to be on websites, school brochures or social media platforms.

[enjay]

I would also add that you should make sure have explicit consent for the use of the pictures on the website.

Some parents may be happy for pictures of their children to be around the school for example, but not happy for them to be on websites, school brochures or social media platforms.

 

Be slightly vague in your explicit consent, though! Use terms like "social media" rather than "Facebook", in case you also set up a Twitter account at some point and want to re-use images previously shared elsewhere. You also don't want to try and manage the parent who consents to the photo being on Twitter but not Instagram.

[GrumbleDook]

Be slightly vague in your explicit consent, though! Use terms like "social media" rather than "Facebook", in case you also set up a Twitter account at some point and want to re-use images previously shared elsewhere. You also don't want to try and manage the parent who consents to the photo being on Twitter but not Instagram.

 

HELL NO!!!!

You should be specific and not generic.

It is not about whether you want the hassle of managing if a picture goes on Twitter but not Insta or FB, it is not your choice. It is that of the parent / child.

If you cannot be transparent about it, then the Consent is not legal.

And yes, talking from experience.

[CyBeRkId2002]

HELL NO!!!!

You should be specific and not generic.

It is not about whether you want the hassle of managing if a picture goes on Twitter but not Insta or FB, it is not your choice. It is that of the parent / child.

If you cannot be transparent about it, then the Consent is not legal.

And yes, talking from experience.

 

I would argue this is completely unmanageable within a school environment - we would have a consent lieft . I disagree entirely that obtaining consent for images to be shared on Social Media (possibly with a couple of examples of what social media is) is not transparent enough. Absolutely it is the parents choice, they are being given a choice in the previous statement.

[enjay]

I would argue this is completely unmanageable within a school environment - we would have a consent lieft . I disagree entirely that obtaining consent for images to be shared on Social Media (possibly with a couple of examples of what social media is) is not transparent enough. Absolutely it is the parents choice, they are being given a choice in the previous statement.

 

Thank you. "Sharing on social media" is perfectly clear, people know what social media is. If someone is okay with their photo being on Twitter but not Facebook, they can decline consent to use on social media.

[synaesthesia]

DPO hat on, yes you must be absolutely specific. It sounds like a pain and you could argue that new SM systems pop up... but the reality is, they don't.

You won't have more than 3, maybe 4 accounts to worry about, it's hardly unworkable to add specifics, or you could make it clear which systems you use and have an "other" consent box to say it's OK for one but not for another.

I would say it's probably acceptable to "merge" some such as Facebook and Instagram, being the same company - but I say probably as I haven't personally checked their privacy statements (don't use Instagram!). It isn't up to us to make assumptions on whether what applies for one should apply to all.

[enjay]

you could argue that new SM systems pop up... but the reality is, they don't.

 

Of course new platforms pop up. Tiktok only came out in 2016 which is within the cycle of our current student body, so if we'd said "Use your image on Facebook and Twitter", we'd have to re-consent the whole school if we then got a TikTok account.

 

 

It isn't up to us to make assumptions on whether what applies for one should apply to all.

 

Perhaps so, but nor is it up to us to accommodate the parent who desperately wants their child's photo on Facebook but doesn't want it on Twitter. If they don't like Twitter, they can tell us not to put their image on social media, and we won't put it on Twitter.

 

 

I would say it's probably acceptable to "merge" some such as Facebook and Instagram, being the same company

 

Risky. What if Meta decide to sell Instagram? Then you'd need to re-consent everyone, and take every image down off Instagram until they had all responded. Alternatively, what if you had Meta and TikTok as two options, a parent consents to TikTok but not Meta, then a year from now Meta buys TikTok - would you go through all the TikTok photos removing the images of the students who had declined use on Meta?

[synaesthesia]

Why is that any different from any other takeover/merger? Happens all the time, just part of life.

Surely no schools actually use TikTok though? I don't think anyone wants to lose that many IQ points?

[EssentialRug]

DPO hat on, yes you must be absolutely specific. It sounds like a pain and you could argue that new SM systems pop up... but the reality is, they don't.

You won't have more than 3, maybe 4 accounts to worry about, it's hardly unworkable to add specifics, or you could make it clear which systems you use and have an "other" consent box to say it's OK for one but not for another.

I would say it's probably acceptable to "merge" some such as Facebook and Instagram, being the same company - but I say probably as I haven't personally checked their privacy statements (don't use Instagram!). It isn't up to us to make assumptions on whether what applies for one should apply to all.

 

Based on conversations we've had with our DPO, agreed here. We specifically ask for consent for each platform. If the school wants to use another platform we ask for consent.

[enjay]

Why is that any different from any other takeover/merger? Happens all the time, just part of life.

 

I suppose the difference is we don't ask for consent for most of the products we use, e.g. SIMS or Parent Mail, so it doesn't matter when ESS buy them both.

 

Surely no schools actually use TikTok though? I don't think anyone wants to lose that many IQ points?

 

Agreed! My point was new platforms do come out, and while we don't want an official TikTok account, we might want one on whatever comes next.

[GrumbleDook]

I would argue this is completely unmanageable within a school environment - we would have a consent lieft . I disagree entirely that obtaining consent for images to be shared on Social Media (possibly with a couple of examples of what social media is) is not transparent enough. Absolutely it is the parents choice, they are being given a choice in the previous statement.

 

Whether it is unmanageable or not is not the problem of the parents or the children.

If you just say 'social media' and list Twitter, Instagram, Facebook, LinkedIn ... what happens when a new platform is used? Do you inform the parent beforehand or just go ahead? What if there is an issue with additional uses that platform introduces that the parent doesn't agree to, even if *your* risk assessment says it should be fine (e.g. they reuse the photos for their own marketing, or perhaps use them to train AI)? Do you expect them to remove consent for all other platforms?

But that means that it could be derimental? A budding athlete could be happy to be promoted by their school, but not for a new platform to reuse the image ...

 

Granular consent is the advice from ICO and there are good reasons for that.

Without that, the DPIA is likely to keep a lot of risks as medium or even high risk.

[Ditto]

Very interesting to see quite polar opposite opinions here around whether you need to call out individual Social Media platforms or can go with calling out "Social Media" alone.

 

I'm currently working with colleagues, including safe-guarding representatives as well as our DPO in relation to using young people's stories to promote and support what we do, so other young people can benefit from our services - we provide emotional wellbeing and mental health support. We are very focussed on individual control of data extremely important, being extremely cautious about what we do with the data, but with a protective eye on safeguarding at all times. We are using consent as our lawful basis.

 

I'm sure we have used the term "social media" and have not called out specific platforms, but I will check. I respect the different opinions and take note of the references to ICO for advice, but for me "social media" is specific enough and although not discussed specifically with our DPO, they haven't flagged it up. I don't think it should be a surprise that there are differences of opinion. There are always going to be differences of opinion and until tested in law courts, it's very difficult to know if each of us has made a bad decision or not. That rarely happens and I'm not aware of any cases to reference for this scenario.

 

I do however believe it is extremely sensible to follow ICO advice, but there is still going to be a degree of interpretation. I had a quick scan around the ICO site and came across the following:

 

https://ico.org.uk/for-organisations/sme-web-hub/whats-new/blogs/taking-photographs-data-protection-advice-for-schools/

 

There's a case study in there - scroll down to the salmon highlighted text. In some ways it's not a million miles from what the OPs situation is, but I do acknowledge there is a big difference in relation to the data going outside the school. What really surprised me, is the use of public task as a lawful basis with no explicit consent to use photos. In our scenario, we have been specific in how we consider internet media material versus hard copy media - the risk assessment led us to consider this.

 

The point is that even going to the ICO site, you might get contrary advice. One DPO may advise differently to another. It's a tricky situation. My conclusion is the best you can do is to conduct the risk review as thoroughly as possible, speak to your DPO, reference ICO advice but above all, remember that you are dealing with children and young people and protection their interests is paramount. Remember a decision they make as an 11 year old might not be a decision they would make as a 16 year old or as an adult. Then make sure it's all documented!

[CyBeRkId2002]

I think the one thing everyone agrees on is that making it clear and transparent how you are using the data (in this case photos) is key. What we disagree on is what that transparency looks like!

 

My personal feelings are that the ICO are not out to demonise people - I totally agree with the principals behind it and people have a right to know what is being shared and where, you have to take a pragmatic, risk assessed approach and put that in to practice in a school environment. In my opinion social media is a perfectly well defined use and we provide parents have a right to opt-out of us sharing their child's information in this way.

 

I would be quite happy having a discussion with the ICO on why we have used the general term, rather than putting in place an unmanageable system within school that ultimately led to an increase in the likelihood of a breach.

[GrumbleDook]

This is one of those situations where it is not the ICO you need to be most mindful about, but the children and their parents.

 

If a parent complains that you are not granular enough, that you were not clear about which platforms would be used, that their child could miss out if they don’t consent to it all …

 

Then it is about whether that complaint is valid and will be upheld by the ICO.

 

This shows the importance of stakeholder engagement when doing DPIAs.

 

And the example from the ICO about public task and the prospectus not working out … well, I think that is one for discussion at the sports bar/ mosh pit /soft play (noisy, gets sweaty and smelly, and you constantly fear having your drink knocked over by someone stumbling around)

[Ditto]

I agree with the first sentence but I'm afraid the last is too cryptic for me to get my head around! Edited March 8, 2022 by Ditto

[GrumbleDook]

I agree with the first sentence but I'm afraid the last is too cryptic for me to get my head around!

 

There is a group of DPOs who have had a number of conversations with ICO staff about their examples and guidance for schools. @AndyCrow can attest as to how frustrating it can be, in spite of the best efforts of the ICO staff. There is still some disconnect between ICO and the education departments in each country.