Edutech98

I think that is an issue - because there isn't any new ICO guidance on taking pictures within school. What I'm trying to risk assess is, is there anything in the new DP/GDPR that could impact the currently published, but old, ICO guidance. For example has the definition of public task changed that would mean the ICO would need to reconsider if the guidance under DPA 1998 is still valid under GDPR/2018. The DfE guidance is great thanks for that. Quick questions ref public task. The guidance on page 23 says photographs used in identify management may be essential for performing the public task of the school. I'm presuming this means ID cards, pictures within Sims etc. How does this fit in within public task? No school *must* put children's photo on ID cards, Sims etc but the guidance suggests you could use public task.

I'd be interested in hearing some specific points on how the new legislation could impact the current ICO guidance. I've asked our DPO team to reconsider our position in light of this thread so will be interested in getting some specific points of why the guidance may change and why we should be sceptical of using it as it is.

It doesn't say the parent should agree. It says they are aware that it is happening. In fairness I don't actually think my approach is that different from everyone else, I just do it slightly different to save the schools time. The consensus here seems to be you get your consent forms out first, split them into 7-8 different groups, get the consent forms back and then input them into some kind of system. This is before any picture is taken. When a picture then wants to be used, you consult your system. Because of how big our trust is, this would require thousands of different inputs. Instead I do it the opposite way.... We tell the data subject or the parent that pictures will be taken as per ICO guidance. We then look at them and decide which ones to use. We then contact the parent/child and inform them as per ICO guidance. If the parents doesn't want us to use it, we won't in line with fair processing. If they do - it gets marked as applicable with the data of conversation and used. This way we only have to input 100's rather than 1000's because we are not informing the child/parent until the time comes. Whether you want to call this consent, or inform, I suppose is irrelevant. The most important thing is we have complied with the ICO and the parent/child has been treated fairly.

They you go pal... https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf

I agree you should take other pieces of legislation into consideration, which the ICO guidance has done, and which all schools should do. I think behavioural charts and pictures of students are very different. I agree some items shouldn't be on display to the public. To say you must cover up all pictures which your initial comment suggested is different than pointing out some items, such as behaviour charts, should have a higher level of security attached to them. It was the other way around, our DPO put the suggestion to me on how the procedure should be (as set out in the other threat). I'm the head of risk and policy for the LA that the school contract to. I agreed with their proposition and still do.

This is where I disagree with most- I don't believe you must use consent or LI. I don't believe this because the ICO has published specific guidance on using picture for websites etc for schools. In the guidance they make no mention of using a different lawful bases - they say providing the school informs the child and/or parent what they are using the pictures for then you can publish the pictures. The ICO know schools use public task. I believe if the ICO wanted schools to use a different lawful bases for putting pics on line then they would have said so in the guidance. The opt out of public pictures, we do so for safe guarding not DP. When we tell the data subject we would like to use there picture, we do this for fair processing as per the ICO guidance. I trust the ICO guidance. If you don't that's fine. If they produce more guidance to say that schools can't publish pictures on their website under public task then I would happily change my stance.

Yes PECR would be used to determine if you can market to parents. PECR would also be taken into consideration when deciding your lawful bases under GDPPR/DPA. You wouldn't consult PECR though to determine your lawful bases, you would consult the GDPR/DPA and the recitals within it. Perhaps I should have said unnecessary rather than a waste! That's in light of the current ICO guidance though, of course this may change in light of new guidance. If someone goes above and beyond the current guidance, then fair play to them. The way I do it, and imo this ticks all the boxes, is I do one agreement when the child starts to ask the parent if they do not want public pictures of their child being used. When we want to put a picture online, for example websites etc, if the parent isn't marked as not wanting pics being used, then we give them a courtesy call to inform them of the specifics. At this point they can decide if they are happy with it or not. We don't put the pics up until this conversation has been had. This way we don't have to manage thousands of consent forms for different platforms that might not even be required. Apologies for the "GrumbleDork" slip up I geniully thought this was your screenname until you pointed it out!!

I think they can under public interest. I can't find their privacy policy but there website seems to suggests they act in the publics interest so presuming that would be the lawful bases they use - "we provide free access to researchers, historians, scholars, the print disabled, and the general public. Our mission is to provide Universal Access to All Knowledge"

Page 19 is completely different to what we are talking about - that's a contract between parties where the parent pays for holiday clubs etc. Clearly that would require consent. PECR is something different - this is marketing via electronic communication. You wouldn't consult PECR when deciding what lawful bases to use to publish a picture - you would use DPA/GDPR. You use PECR to consult if you can market someone electronically. If you see all of my replies, and the ICO guidance, it clearly says you must inform the parent or child the context of what the picture is being taken for - no one is disputing this?

Yes not impossible, but unusual, hence the word unusual and not never The advice would still be exactly the same though, remove the picture as requested and any pictures in the public domain take reasonable steps to remove taking into consideration the available technology to do so and the cost.

If you follow the ICO's advice you don't need to ask for a specific number of years to have the pictures on the website. You just need to inform them that you'd like to put their picture up on your website. If they are happy to do so then you can keep the picture on for as long as it is still fulfilling the same purpose and not used in a way that is different to what was originally explained to the data subject. If they leave and then object to the pic, which would be very unusual and I've never had happen, then you can take reasonable steps to try and remove the pictures from archive.org etc taking into account the available technology and cost of doing so.

This is what the Old DPA Act said about consent; “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed” and “the data subject has unambiguously given his consent” Consent could never be inferred, it could never be implied, badly written opt-out buried it terms and conditions was never consent. This is still the same - just now the GDPR stresses this because of how badly the old DPA was abused by people making words up like "oh this is inferred consent that I'm using". This was never consent. They can object becuase as per the ICO's common sense approach, this is a fair approach. If the guidance wanted to say you needed consent- it would say "for schools to use pictures in a prospectues you need a different lawful bases other than public task". But it doesn't say this - it says as long as you inform the subject what you are doing and what the pics will be used for then you will not breach DP law.

What part of the law do you think has changed that would effect this? Consent is pretty much the same and public task is pretty much the same. The ICO is still saying they will take a pragmatic approach to data protection. The ICO website says although there are some subtle differences between the old and new laws the guidance is still considered useful.

I agree you shouldn't presume media is exempt, but this is to do with safe guarding and not data protection. The ICO guidance says "photograph is taken by a local newspaper of a school awards ceremony. As long as the school has agreed to this, and the children and/or their guardians are aware that photographs of those attending the ceremony may appear in the newspaper, this will not breach the DPA" I've linked to the ICO guidance in the other thread where they make it clear that putting pictures in a prospectus will not breach DP laws providing the person is aware it is happening. Covering up pictures in a school seems like a bit pointless and is verging on paranoia imo. What risk could this possibly bring? There are people that walk past children going into the school on a daily bases, we don't ask them to blindfold themselves so they can't see the pupils. As per the other thread, a granular approach doesn't seem like common sense which is the advice the ICO has given to schools ref pictures. Our schools would end up with thousands of individual consents for separate platforms - this would just not be workable. A single form stating you can or cannot publish pictures that may be seen by the public is enough imo for safe guarding and is workable. If a specific parent wants more granular control then deal with this as a ad hoc requirement.

Just to be clear I don't use LI for pictures, everything we do in the school we do under public task, including pictures. I was just throwing it out as an idea for someone who wanted to use an alternative to public interest such as consent - some interesting things for me to think about so thanks for the comments! The ICO already recognises that schools will use public tasks as their lawful bases for anything to do with educating/protecting students. Pictures it seems is a but of a grey area, e.g do pics within the school help educate students, is an attractive website that helps a child pick their school in the public's interest etc. The ICO seems to recognise this and has published their guidance some years ago called "Taking photographs in Schools". This is available here; https://ico.org.uk/media/for-organisations/documents/1136/taking_photos.pdf In the guidance they specifically address taking pictures of students for "marketing purposes". They suggest to use a common sense approach. To quote "A small groups of children are photographed during a science lesson and the photo is used in the school prospectus. This will be personal data but will not breach the DPA as long as the children and/or parents are aware this is happening and the context of the picture." There is no suggestion of using an alternative lawful bases, no requirement to gain consent, no opt in or granular permissions for different platforms. Just good ol' common sense. If you go above and beyond this, fair enough that's not wrong, I just think its could be a bit of a waste of school resources and not required to comply with the DP laws as per current ICO guidance.

Necessity doesn't have to mean it is absolutely essential. Necessity, as defined by the ICO, means "targeted and proportionate way of achieving your purpose". To determine if something is proportionate we have to balance the risk to the data subject Vs what we are trying to achieve. The risks to the data subject are embarrassment and safe guarding. We mitigate these by telling the data subject that we would like to use their picture. If they refuse, we couldn't put it up as it wouldn't pass the fairness test. The benefits are a nicer looking website, motivated data subject, inspired student, happy parents/grandparents etc. So you've got lots of benefits vs a risk that has been mitigated. I would argue this makes it a proportionate approach to take and is in line with the ICOs common sense approach.

My post suggested to use legitimate interest for photo's on a school website, rather than consent. The school would need to do the legitimate interest balancing test first, but would be much easy for the school than consent.

The law doesn't say you have to use consent, there are other lawful bases. A company can use your photo without your permissions, for example CCTV images used at a football match to identify barred customers. I'm saying the school does have a right to use the image - they have a lawful bases of public interest. They believe that publishing pictures within the school, amongst other things, motivates the data subject. It also motivates other students, whether through inspiration or making the school look better. In the interest of fair processing and being transparent, the school should ask for permission, but this doesn't mean you are using consent. You can ask for permission and still use the lawful bases of a contract for example. The ICO guidance of using pictures in a school doesn't say you need to use consent, it just says to use a common sense approach.

For photo's on the website - the school has a legitimate interest in attracting students and parents to the website. They do so by incorporating pictures into the design of the website, so it looks slicker / more appealing / more interesting to its users. They need to balance the legitimate interest against the risks to the data subject. I would argue that the risks are on the very low side. To mitigate the already low risks, the school can inform the students/parents that they intend to use a picture with them in it. The child/parent has an opportunity to stop this if they want. If they do, in light of fair processing and safe guarding, the school should not use the picture. If they don't object, then the school has weighted their interests against the risk and I would argue it weights in the schools favour as there are no longer any reasonable risks. For photo's around the school this is my rationale - The school has a public task set out to educate children. They have different strategies for doing this, including motivating students, inspiring them, making the school an attractive place, making them feel part of the school etc. Putting pics up of a children can and does motivate, inspire and include them - which helps educate the children. The ICO has already accepted in guidance how much pleasure pictures of children in a school can bring. To use public task the data processing has to be neccessary. The ICO define necessary as "a targeted and proportionate way of achieving your purpose". I would argue that motiving children, by putting pictures up of them, is proportionate when you take into account the benefits vs the almost zero risks of putting up a picture in a school of a child. Similar they inspire other students with almost zero risk. Using consent adds a whole world of trouble - you could have 1000's of individual consent forms, you need to have opt in, you need to be able to identify students in pictures, you need a way of removing pictures etc. All this seems a lot of work, especially in light of the ICO saying school should take a common sense approach and just asking for permissions before a photo is taken is enough to comply with DP laws.

I'm still not sure I agree with this. Pictures in the school would surely be public task that is used and not consent? Photos external on websites etc would be legitimate interest. Otherwise the school is in a position where they would need to manage thousands of consent forms.

Imo I don't think any of this is necessary and causes extra work that you don't need to do. The ICO guidance on photographs taken in school says to take a common sense approach, and if the photographer/teacher asks for permission to take a photograph that will be enough for compliance. It doesn't seem you need a granule permissions for every student and every eventuality of picture. To cover save guarding, and fair processing, in addition to this I recommend to my schools using one opt-in for pictures to be taken that could be used publicly, i.e website, prospectus etc. This isn't gaining consent in the DP term, it is mainly to cover safe guarding. If you wanted to attach a lawful bases for your own documentation I would personally use these; School Website - legitimate interest SChool image/work - if this is connected to the students work public task outside bodies/agencies - public task school prospectus - ICO guidance says as long as the child and/or parent is informed then this will not breach the act Media - covered by journalist exemption - providing the child and/or parent is informed Tapestry - If this is connected to the curriculum then public task Reports to governors - public task photos in classrooms - public task photos in public area - either legit interest or public tasks

This is what the ICO guidance says... "A small group of pupils are photographed during a science lesson and the photo is to be used in the school prospectus. This will be personal data but will not breach the Act as long as the children and/or their guardians are aware this is happening and the context in which the photo will be used."

I also think this is getting confused between consent and fair processing. You don't need consent to take a picture of a child in a class, nor to put it on a prospectus, it would generally be done under a task carried out in the public interest. However you need to process data fairly, so you should inform the parent/child that they are having their picture taken and what the picture is for. If they decide they don't want the picture taken, then it would be a fair expectation for the child not to have the picture taken. You are not asking for consent - because you are not using consent as the lawful bases - you are just informing them and acting fairly whilst using public interest as your lawful bases.

You would need to think about two things that spring to mind; 1) The risks that an unauthorised person saw this data 2) The varying likelihood and severity for the rights and freedoms of the student if this data was saw but an unauthorised person. You can mitigate some of the risks of 1) with things like screens in restricted areas, DBS/CRB checks of non-employed people in the school etc, displays at certain times of the day ie 9-3 only. For number 2 you'd need to balance what you are trying to achieve (I'm presuming motivation of students, making them feeling included within the school etc) against the risks identified in number 2 to determine if you feel it is an acceptable risk. Just because a set of data identifies a person doesn't necessarily mean you should not display it. Likewise the protection that you put in place to mitigate risk 1 does not need to be perfection where it is impossible the data could ever be seen by any unauthorised person.

I wouldn't have a problem with the police officer doing that. The law enforcement directive sets out how the police are required to handle this type of data including the security of it. I think its reasonable of the school to presume that they are handling data in line with the directive without needing to confirm this. Although... the first school I worked at a teacher started and a few weeks later went AWOL. There was a bit of a rumour it was drugs related and one day two non-uniformed police officers turned up as I was fixing one of the reception computers. The receptionist called the head and he came down. The police officers introduced themselves as GMP and told them they were investigating this teacher and believed the school employed him. The head confirmed this and the police asked if they had an address for him. The head happily obliged and asked the receptionist to print his address. Off they went and at that point the head asked who confirmed there ID - everyone looked at everyone else and all shrugged there shoulders. I've never seen someone change from white to red so fast His only comment was "oh sh1t"