We consider the potential issues with taking photographs in a school setting following on from our case study of a DPO in a school:

Taking photos with own mobiles

Teaching staff regularly use their personal mobile phones to take photographs of the students and their work for files to evidence student development through the year.  There is only one school camera and it is the one thing that regularly gets forgotten when teaching staff take students on field trips and visits to places of interest.  So staff improvise by using their personal devices.

Having photographs of students on a personal mobile phone is strictly prohibited in the school policies and procedures because:

  • It is inappropriate for staff to have photos of students
  • The photos must be transferred to school files which will probably be done by email which means sending the photos (personal data) unprotected in an email, another breach of internal policies and procedures
  • Staff may forget to delete the photos after sending them to the school
  • While photos are held on personal mobiles the school must include a search of mobile phones when responding to the exercise of subject rights such as subject access, requests for erasure of data, restricting data processing etc
  • Photos on mobile phones may not be backed up and could be lost
  • Unless there is a policy in place to regulate use of own devices (a Bring Your Own Device Policy and Procedures) then mobile phones might not have any protection, putting the photos at risk of unauthorised access or deletion

Consent forms

Parents are asked for consent to photos of their children being taken for purposes including displays in classrooms, evidencing learning journeys and records of achievements.  The consent form also covers the standard school photo taken by a commercial photographer for sale to parents.  However Rowena is concerned that the wide use of photos by the school to illustrate publications such as the School Prospectus is probably not clear from the wording.  Also the huge increase in the use of photos on social media certainly raises issues around the longevity of the photos and the lack of control once they are published to the internet.

Rowena needs to revisit the consent forms and restrict the use of photos of the students until an appropriately detailed consent form is available.

Our DPO Support Package recommends that the DPO review complaints to identify any that involve a data protection issue.  Further issues with photographs and consent forms are highlighted when Rowena reviews the complaints file:

  • Particularly good photos of students may be held and used for longer than stated on the consent form without seeking further consent from the parents, for example on a video loop in school reception area to illustrate and promote the typical activities of the school
  • Staff are not aware that students who object to the use of their image are in fact exercising their legal right to object to the use of their personal data.  Children have data protection rights and may exercise them without input from their parents in some circumstances
  • There are occasions when the intended use of the photo requires further explanation and context in addition to the generality of the consent form, for example a parent who agrees to the use of a student’s image in the School Prospectus might balk at the image being on the front cover, A4 size, imagining only that a small cameo would be included in the inside pages.  For processing to be fair it is important to identify when the standard consent form is inadequate and needs supplementary information to give it context

Photographs of children in wheelchairs

Rowena’s investigation would probably find that staff steer well clear of photos of students with disabilities, bearing in mind that a physical disability is personal data relating to health and therefore “special category data” requiring additional conditions for lawful processing.  We would suggest that Rowena develop an appropriate policy and procedure for use of photos which may include special category data and give clear guidelines to colleagues for their safe and compliant use.