Picture perfect: data protection essentials for photography in schools and colleges

Using photographs and videos in schools and colleges often raises data protection concerns. Whether it's for ID passes, marketing, or capturing memories, there are important considerations to keep in mind.

Understanding Personal Data

If a student can be identified from a photograph, it counts as personal data and falls under data protection laws. When photos are taken for school or college purposes, such as ID passes or website use, the institution becomes the controller and is responsible for compliance with data protection laws.

Steps for Compliance

1. Identify your lawful basis

Every use of personal data requires a lawful basis under UK GDPR. For schools and colleges, the most relevant lawful bases for use of photographs and videos are public task, legitimate interests, and consent. 

• Public Task: LEA schools, academy trusts, and FE colleges may be able to use this basis when the personal data use is necessary for the public interest or where they are doing something under their official authority i.e. in fulfilling their core role as an education provider.  An example of where this may be relevant is the use of photographs on ID passes.
• Legitimate Interests: Independent schools and colleges might use this basis when students expect their personal data to be used in a certain way, like group photographs without names. This lawful basis is not available to LEA schools, academy trusts and FE colleges in relation to the use of personal data in carrying out their core role as an education provider.
• Consent: Needed for non-essential activities, such as promotional use, or when the photograph has a significant privacy impact, like naming the student.

2. Ensure valid consent

If you are relying on consent, it must meet UK GDPR standards. Consent should be clear, detailed, and actively given—no pre-ticked boxes. It should also be easy to withdraw. Remember, consent needs refreshing periodically.

Students who opt out shouldn't be excluded from activities involving photography. Consider using stickers or badges to indicate that they shouldn't be photographed. Even where you are not using consent as the basis for the photograph/video you should offer opt-out options, especially if using the photograph/video for marketing purposes. 

Always consider your safeguarding obligations before using a student's photograph as these may override your ability to use it under UK GDPR.

3. Seek appropriate consent

Communicate with students about the use of their personal data once they are old enough to understand it. There is no set age under UK GDPR and it comes down to the student’s level of understanding. 

The NSPCC advises that children should always be consulted about the use of their image. Additionally, they recommend that consent is given by those with parental responsibility where a student is under the age of 16. Therefore, you might have to get the consent of the student (if they are able to understand how their personal data is used) and their parents.

4. Have a transparent photography policy

Clearly inform parents and students about how you intend to use photographs. Publish a photography policy alongside your student privacy notice. Ideally you would provide this information at the start of each school year and highlight key events where photographs will be taken (for example, sports day or annual class photographs). You should explain how to consent or opt out.

5. Additional considerations

• Parents and guardians: They can take photographs for personal use, like sharing on private social media. However, schools can adopt policies to restrict photography at events or request that other people don't share photographs of other children online. This is a sensible approach and many schools and sports clubs who have participants under 18 have restrictions.
• CCTV and Facial Recognition: These technologies require careful consideration. You can read more about our insights into facial recognition in schools here. 

6. Checklist of the key points to remember:

• Identify personal data: If a student can be identified from a photograph, it counts as personal data and is subject to data protection laws.
• Lawful basis: Determine the lawful basis for using photographs or videos. Options include public task, legitimate interests, and consent.
• Valid consent: Ensure consent is clear, detailed, and actively given. It should be easy to withdraw and needs to be refreshed periodically.
• Transparency: Clearly inform parents and students about how photographs will be used. Publish a photography policy and provide it at the start of each school year.
• Opt-out options: Offer students and parents the chance to opt out, especially for marketing purposes. Use stickers or badges to indicate students who shouldn't be photographed.
• Safeguarding: Always consider safeguarding obligations before using a student's photograph.
• Parental photography: Parents can take photographs for personal use, but schools can adopt policies to restrict photography at events or request not sharing photographs of other children online.
• CCTV and facial recognition: These require careful consideration and compliance with data protection laws.

We can help

Our data protection team, led by Joanne Bone, can help your school or college to use student photographs in a legally compliant way. Joanne Bone provides practical advice and has extensive experience in data protection issues relating to the education sector. 

Our newsletters

We publish monthly employment and education newsletters. If you'd like to be added to the mailing list, please let me know.