We’ve updated this blog to clarify and expand on a few key points for small schools in England, Wales and Northern Ireland, and small independent schools in Scotland. Managers at small groups and clubs may also find this advice helpful. Local authority-run schools in Scotland can access data protection support and should discuss this guidance with their DPO.
School years fly by so quickly, and a lot can happen from one year to the next. Taking photographs of your lessons, events and activities helps to capture those precious memories for your students and showcase the way you do things in your school.
Here’s what you need to do to make sure your data protection practices aren’t holding you back.
Decide which lawful basis is right for your school
If someone can be recognised from a photograph it’s usually considered their personal data. As with any use of personal data, choosing your valid reason or ‘lawful basis’ is essential.
Use our lawful basis checker to help you decide which basis is right for taking photographs at your school. There are two you’d be likely to choose:
- Public task can be relied on if you’re a public body exercising your legal duties or powers, or a private sector body with a specific public interest task set out in law.
- Legitimate interests is more wide-reaching and can be relied on when you’re doing something outside the scope of any public functions and processing data in a way people might expect or you can justify. This can include promotion and marketing.
In most cases, we’d expect publicly-funded schools to be looking at public task. Independent and other schools can look at either public task (if they can point to a relevant legal function or power) or legitimate interests.
If you choose either of these as your lawful basis, this allows you to balance everyone’s interests to achieve the fairest outcome. You must tell people upfront what you’re going to do with their personal data so they know what to expect from the beginning. Where possible, you should also still give them the chance to opt out. If you want to use student photos for promotional purposes, we would still generally expect you to offer an opt-out to parents (or the students themselves if they’re old enough to make their own decisions).
Offering an opt-out doesn’t mean you are relying on ‘consent’ as a lawful basis under data protection law.
Consent means giving people full control over and responsibility for their data including the ability to change their mind as to whether it can continue to be processed. This means that, in some cases, consent may not be the most appropriate option.
For example, Sue’s school wants to showcase the achievements of Dominic, one of her students, in the school’s prospectus. The prospectus provides relevant information to students and parents as part of the school admissions process.
She tells Dominic and his parents that she wants to print his name and photograph in the prospectus, and asks if he wants to opt out. He doesn’t opt out, so she considers it’s reasonable to go ahead and use the photo. She uses public task as her lawful basis.
Dominic later decides that he doesn’t like the photograph and tells the school he doesn’t want it to be used. Sue considers the objection, and agrees that they won’t use the photo in future materials or in any digital media.
Although Sue may need to take the photo down from the school's website, she doesn't necessarily have to recall or destroy existing paper copies of the prospectus - although she should of course consider any child welfare issues.
Be proactive and let people know what’s coming up
It’s a good idea to provide your policies for recording and using photographs at the start of the academic year, including any key events where your school will take photographs, and details of how to opt out. That way, everyone knows what to expect and can opt out if they want. If you have another photo opportunity coming up later in the year, a reminder can always be helpful. Being proactive and transparent shows that you care about the data of your students and helps to build trust.
Most schools provide an opportunity to buy individual or class photographs taken by an external professional during the school year. If you’re planning to offer this, you should let parents, guardians or students know in advance when the photographs will be taken and give them the option to opt out. Keep a record of which students have opted out and make sure staff are aware.
Store files securely and train your staff
When it comes to children’s data – including photographs – you need to take particular care that you keep it safe and don’t give it to anyone who shouldn’t have access to it. Make sure your school keeps a record of any safeguarding procedures in place to protect particular students and train your staff regularly to avoid the risk of a breach. You also need to make sure that you can access your photographs when needed in case someone requests a copy of their information.
If you have strong data protection practices that your staff understand and follow, you’ll not only earn a reputation in your community as a school that takes its data protection responsibilities seriously, but you’ll also be able to capture and keep a record of those key moments.
Data protection doesn’t cover personal use
People can take photographs and video recordings for personal use, such as for a family album. However, your school may decide it isn’t always appropriate to allow photographs. For example, you might decide to ban photography at a school play in case it disturbs the performance. This is your choice as a school, but the ban wouldn’t be on data protection grounds. Similarly, some schools ask parents and guardians not to post photographs on social media of other people’s children. This is a sensible policy, but it’s not a data protection issue because the law doesn’t cover private social media posts shared with friends and family.
Your school may find it helpful to signpost students and guardians to our For the public web hub to learn about their data rights.
Also see: