Edutech98

I think that is an issue - because there isn't any new ICO guidance on taking pictures within school. What I'm trying to risk assess is, is there anything in the new DP/GDPR that could impact the currently published, but old, ICO guidance. For example has the definition of public task changed that would mean the ICO would need to reconsider if the guidance under DPA 1998 is still valid under GDPR/2018. The DfE guidance is great thanks for that. Quick questions ref public task. The guidance on page 23 says photographs used in identify management may be essential for performing the public task of the school. I'm presuming this means ID cards, pictures within Sims etc. How does this fit in within public task? No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task.

I'd be interested in hearing some specific points on how the new legislation could impact the current ICO guidance. I've asked our DPO team to reconsider our position in light of this thread so will be interested in getting some specific points of why the guidance may change and why we should be sceptical of using it as it is.

It doesn't say the parent should agree. It says they are aware that it is happening. In fairness I don't actually think my approach is that different from everyone else, I just do it slightly different to save the schools time. The consensus here seems to be you get your consent forms out first, split them into 7-8 different groups, get the consent forms back and then input them into some kind of system. This is before any picture is taken. When a picture then wants to be used, you consult your system. Because of how big our trust is, this would require thousands of different inputs. Instead I do it the opposite way.... We tell the data subject or the parent that pictures will be taken as per ICO guidance. We then look at them and decide which ones to use. We then contact the parent/child and inform them as per ICO guidance. If the parents doesn't want us to use it, we won't in line with fair processing. If they do - it gets marked as applicable with the data of conversation and used. This way we only have to input 100's rather than 1000's because we are not informing the child/parent until the time comes. Whether you want to call this consent, or inform, I suppose is irrelevant. The most important thing is we have complied with the ICO and the parent/child has been treated fairly.

They you go pal... https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

I agree you should take other pieces of legislation into consideration, which the ICO guidance has done, and which all schools should do. I think behavioural charts and pictures of students are very different. I agree some items shouldn't be on display to the public. To say you must cover up all pictures which your initial comment suggested is different than pointing out some items, such as behaviour charts, should have a higher level of security attached to them. It was the other way around, our DPO put the suggestion to me on how the procedure should be (as set out in the other threat). I'm the head of risk and policy for the LA that the school contract to. I agreed with their proposition and still do.

This is where I disagree with most- I don't believe you must use consent or LI. I don't believe this because the ICO has published specific guidance on using picture for websites etc for schools. In the guidance they make no mention of using a different lawful bases - they say providing the school informs the child and/or parent what they are using the pictures for then you can publish the pictures. The ICO know schools use public task. I believe if the ICO wanted schools to use a different lawful bases for putting pics on line then they would have said so in the guidance. The opt out of public pictures, we do so for safe guarding not DP. When we tell the data subject we would like to use there picture, we do this for fair processing as per the ICO guidance. I trust the ICO guidance. If you don't that's fine. If they produce more guidance to say that schools can't publish pictures on their website under public task then I would happily change my stance.

Yes PECR would be used to determine if you can market to parents. PECR would also be taken into consideration when deciding your lawful bases under GDPPR/DPA. You wouldn't consult PECR though to determine your lawful bases, you would consult the GDPR/DPA and the recitals within it. Perhaps I should have said unnecessary rather than a waste! That's in light of the current ICO guidance though, of course this may change in light of new guidance. If someone goes above and beyond the current guidance, then fair play to them. The way I do it, and imo this ticks all the boxes, is I do one agreement when the child starts to ask the parent if they do not want public pictures of their child being used. When we want to put a picture online, for example websites etc, if the parent isn't marked as not wanting pics being used, then we give them a courtesy call to inform them of the specifics. At this point they can decide if they are happy with it or not. We don't put the pics up until this conversation has been had. This way we don't have to manage thousands of consent forms for different platforms that might not even be required. Apologies for the "GrumbleDork" slip up I geniully thought this was your screenname until you pointed it out!!

I think they can under public interest. I can't find their privacy policy but there website seems to suggests they act in the publics interest so presuming that would be the lawful bases they use - "we provide free access to researchers, historians, scholars, the print disabled, and the general public. Our mission is to provide Universal Access to All Knowledge"

Page 19 is completely different to what we are talking about - that's a contract between parties where the parent pays for holiday clubs etc. Clearly that would require consent. PECR is something different - this is marketing via electronic communication. You wouldn't consult PECR when deciding what lawful bases to use to publish a picture - you would use DPA/GDPR. You use PECR to consult if you can market someone electronically. If you see all of my replies, and the ICO guidance, it clearly says you must inform the parent or child the context of what the picture is being taken for - no one is disputing this?

Yes not impossible, but unusual, hence the word unusual and not never The advice would still be exactly the same though, remove the picture as requested and any pictures in the public domain take reasonable steps to remove taking into consideration the available technology to do so and the cost.

If you follow the ICO's advice you don't need to ask for a specific number of years to have the pictures on the website. You just need to inform them that you'd like to put their picture up on your website. If they are happy to do so then you can keep the picture on for as long as it is still fulfilling the same purpose and not used in a way that is different to what was originally explained to the data subject. If they leave and then object to the pic, which would be very unusual and I've never had happen, then you can take reasonable steps to try and remove the pictures from archive.org etc taking into account the available technology and cost of doing so.

This is what the Old DPA Act said about consent; “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed” and “the data subject has unambiguously given his consent” Consent could never be inferred, it could never be implied, badly written opt-out buried it terms and conditions was never consent. This is still the same - just now the GDPR stresses this because of how badly the old DPA was abused by people making words up like "oh this is inferred consent that I'm using". This was never consent. They can object becuase as per the ICO's common sense approach, this is a fair approach. If the guidance wanted to say you needed consent- it would say "for schools to use pictures in a prospectues you need a different lawful bases other than public task". But it doesn't say this - it says as long as you inform the subject what you are doing and what the pics will be used for then you will not breach DP law.

What part of the law do you think has changed that would effect this? Consent is pretty much the same and public task is pretty much the same. The ICO is still saying they will take a pragmatic approach to data protection. The ICO website says although there are some subtle differences between the old and new laws the guidance is still considered useful.

I agree you shouldn't presume media is exempt, but this is to do with safe guarding and not data protection. The ICO guidance says "photograph is taken by a local newspaper of a school awards ceremony. As long as the school has agreed to this, and the children and/or their guardians are aware that photographs of those attending the ceremony may appear in the newspaper, this will not breach the DPA" I've linked to the ICO guidance in the other thread where they make it clear that putting pictures in a prospectus will not breach DP laws providing the person is aware it is happening. Covering up pictures in a school seems like a bit pointless and is verging on paranoia imo. What risk could this possibly bring? There are people that walk past children going into the school on a daily bases, we don't ask them to blindfold themselves so they can't see the pupils. As per the other thread, a granular approach doesn't seem like common sense which is the advice the ICO has given to schools ref pictures. Our schools would end up with thousands of individual consents for separate platforms - this would just not be workable. A single form stating you can or cannot publish pictures that may be seen by the public is enough imo for safe guarding and is workable. If a specific parent wants more granular control then deal with this as a ad hoc requirement.

Just to be clear I don't use LI for pictures, everything we do in the school we do under public task, including pictures. I was just throwing it out as an idea for someone who wanted to use an alternative to public interest such as consent - some interesting things for me to think about so thanks for the comments! The ICO already recognises that schools will use public tasks as their lawful bases for anything to do with educating/protecting students. Pictures it seems is a but of a grey area, e.g do pics within the school help educate students, is an attractive website that helps a child pick their school in the public's interest etc. The ICO seems to recognise this and has published their guidance some years ago called "Taking photographs in Schools". This is available here; https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf In the guidance they specifically address taking pictures of students for "marketing purposes". They suggest to use a common sense approach. To quote "A small groups of children are photographed during a science lesson and the photo is used in the school prospectus. This will be personal data but will not breach the DPA as long as the children and/or parents are aware this is happening and the context of the picture." There is no suggestion of using an alternative lawful bases, no requirement to gain consent, no opt in or granular permissions for different platforms. Just good ol' common sense. If you go above and beyond this, fair enough that's not wrong, I just think its could be a bit of a waste of school resources and not required to comply with the DP laws as per current ICO guidance.