In light of recent ICO reprimands to schools it is important schools remember best practice for managing photos. The formal legal warnings issued by the ICO recently to schools both related to the processing of photos where no consent had been given.
It is clear from our visits to schools that most of you have good systems in place to gain consent and that your forms cover the multitude of uses that exist these days. However, systems are only as good as their implementation so ensure that as an organisation you have worked through our Best Practice Checklist for use of photos and videos https://kb.dataprotection.education/index.php/best-practice-library/best-practice/photos-and-video
In many cases of poor practice resulting in bad management of data and a breach, the root cause can be traced back to training and awareness. Make sure that all staff understand the systems the school has in place and most importantly the reason for those systems.
- Are your uses of photos clearly defined? These should be presented to staff, parents and students via your privacy notices.
- There should be a number of challenges to your management, admin and teaching teams:
- Who is taking photos and are they stored securely?
- If classroom staff take photos are they on a school managed device?
- Is the device used additionally by students in the classroom?
- For trips, do you provide clear guidelines to parent helpers on not taking photos with personal devices?
- Is there a process to remove photos taken and store them securely on a network drive?
- Does your declared use of photos support the photos you keep? How is your housekeeping managed to delete unrequired files?
- How do staff identify students where no family consent has been given?
- Who posts photos to websites and social media accounts?
- Does staff training cover best practice for photos and videos?
- Are you keeping your procedural documents up to date and recording staff training provided? These records can evidence your compliance to the ICO.
Mismanagement and misuse of photos can at best cause upset to families and at worst lead to a safeguarding incident so be mindful of these risks and take training seriously ensuring it is inclusive of all staff.
Remember that any photos taken by the school for official use such as websites and brochures require consent and best practice should be followed at all times. However, photos taken for use within the school for educational purposes do not require consent and neither are photos taken by families of school events such as sports day or school plays, which would be classed as for household or personal use. Be clear on your responsibilities and ensure you give clear and friendly advice to families on the use of any photos they might take on these occasions.
Ensure, as well, that all staff know how to identify and report a data breach as, should the worse happen, incidents need to be reported promptly to the ICO. We have an excellent reporting tool for breaches https://kb.dataprotection.education/breach-log/ and also have helpful drip-feed posters to help staff know how to identify and report a breach https://kb.dataprotection.education/best-practice-library/documents/drip-feeds
If in any doubt always contact the Data Protection Education team: