Taking photos at school events – Where common sense comes into play
The introduction of the General Data Protection Regulation (GDPR) has triggered a significant shift in people’s perception of data protection, and organisations across all types of sectors are contending with different challenges in terms of ensuring they are balancing their interests with the rights of individuals around their personal data. This blog post looks at one of the challenges experienced in the education sector, namely the taking of photographs at school events.
The DPC often receives queries from schools, parents and even photographers about taking photographs at school events. These events range from concerts and football matches, right up to sports days, holy communions, and award ceremonies. Common questions ensue such as “Do you need the consent of a child’s guardian before you can take a photo of a child?”, “Do you need consent for each separate school event?”, “Can schools ban parents from taking photos at school events?”, and “Can people take photos of other people’s children without the guardian’s permission?” The phrase “Because of GDPR” is also trending of late, and this context appears to be no different when we hear things such as schools saying “We can publish a photo of a student but we can’t name them because of GDPR” or parents saying “I can’t take a photo of my child in the nativity play because of GDPR”, highlighting the real sense of confusion surrounding this issue.
Back to basics
Before we delve into the school- and child-specific context, let’s go back to basics for a moment. As Commissioner for Data Protection Helen Dixon stated in a recent interview with the Irish Independent, there is nothing under the GDPR prohibiting people from taking photos in a public place. Provided you’re not harassing anyone, taking photographs of people in public is generally allowed. However, whether you can publish a photograph to a broad-based audience is a different question. In other words, taking a photo in public is generally fine; it’s what you do with that photo that can potentially become a data protection issue.
You’ll notice the repeated reference to the word “public” above – this is an important factor to take into consideration in a school event context. The rules of engagement for taking photos at a school nativity play put on specifically for friends and family are likely to differ to those applied at a ticketed school musical open to the public.
Family and friends taking photos at school events
School plays, rugby matches, Christmas carol concerts – all important milestones that parents, family and friends understandably want to record on camera. But questions such as “Is it OK if you capture the image of another child while snapping pictures of your own?” surface time and time again, leaving parents, and indeed schools, at a bit of a loss as to what to do. A lot of the time, families taking photos at these kind of events are simply doing so for reminiscence’s sake and they don’t intend to post or publish the photos anywhere. This type of activity falls under the so-called “household exemption” under the GDPR, which provides that the GDPR does not apply when a person processes personal data (for example, a photograph of someone) in the course of a purely personal or household activity, e.g. with no connection to a professional, business, official or commercial activity.
That being said, the ubiquitous nature of social media means that many photos like these will inevitably wind up on some proud parent’s Instagram account. And in fact, the GDPR doesn’t strictly prohibit this either, with Recital 18 stating that personal or household activities could include social networking. However, if a parent published a photo of their child online that also contained images of other children, and the parent of one of the other children was uncomfortable with this and asked the parent to take the photo down, common sense and indeed common courtesy would suggest that you should take the photo down.
In an effort to maintain a sense of control over the situation, some schools are implementing an outright ban on the taking of photographs by parents/family at school events. While it is at the discretion of schools to create their own policies on these matters for closed school events, it may be rather difficult to enforce an outright ban – in the name of data protection – on taking photos at, for example, the school’s production of Grease the Musical which members of the public can also attend.
Official photography at school events
Schools often take photographs or hire photographers to attend school-related events to capture important occasions, for example the opening of a new science lab, a school orchestra’s annual concert, or the final of a football tournament, with these images winding up on the school’s website, in the local newspaper, or in the school’s monthly newsletter. It’s important to note that in this context, schools are in a very different position to parents/family/friends in that they cannot rely on the household exemption. They are acting as data controllers which brings them into the sphere of the GDPR and all of the rules that come with it, for example they must have a legal basis to process the personal data (e.g. take and store photos) and they must provide clear and concise information about what it is that they are doing with this personal data, how long they will be keeping it for, etc.
There are six legal bases for processing personal data under the GDPR, and schools must ensure they can rely on one of these legal bases before they can process the personal data (in this case – photos) of their students. The DPC recently heard an anecdote about a school who provided a newspaper with a photograph of two students who had won a prize in a national competition, but claimed they couldn’t provide the newspaper with the names of these students because of GDPR. Processing personal data includes a multitude of activities such as taking photographs of students, publishing these photos somewhere, and naming students in publications. So if the school in this scenario had a valid legal basis for publishing photographs of their students in the first place (for example the school had obtained the consent of the parents of the students), it’s unlikely that they were not in a position to name the students too.
If a school has identified that consent is the appropriate legal basis for taking and publishing photographs in a particular context, they will generally need to obtain the consent of the child’s parent or guardian to do so, depending on the age of the child. The threshold for consent is strengthened under the GDPR and requires that the consent be freely given, specific, informed and unambiguous. It must also be possible for the parent or guardian to withdraw their consent at any time, bearing in mind, however, that withdrawal of consent doesn’t affect the previous use of any photos taken of that particular child before the consent was withdrawn.
If a school is requesting consent from a parent or guardian to photograph their child at school events, it is vital that the school provide a clear and accurate account of the context in which these photos are going to be taken, for example the types of school events that photographs will be taken at, what these photos are going to be used for and by whom, where these photos are going to appear and how long they will be kept for. It’s also important that parents/guardians are aware that they have a right to withdraw their consent at any time to the future use of such photos.
Schools may find it easier to request this consent from parents/guardians at the beginning of each school term or year so that the consent can clearly cover specific activities throughout the course of the school term/year. However, in the event that the nature and context in which photographs are taken fundamentally changes, for example the photos are going to be taken at an event that parents wouldn’t expect them to be taken, or they are going to be posted or published somewhere unexpected, then schools should, once again, seek consent from parents or guardians.
But we shouldn’t overlook children and young people themselves in these scenarios. They also have rights in relation to their personal data and should be made aware of the fact that their images are being taken and used, for example, in the local newspaper. If a school is relying on consent as their legal basis, then the age of students intended to be photographed should be taken into account when it comes to seeking consent because the students may be capable of making that decision for themselves. For example, the parent of a 15-year old may have given consent for photographs to be taken of their child at the school’s talent show for publication in the local newspaper – however, the 15-year old may very well have objections to this and may not wish to appear in the local newspaper. Schools themselves are in the best position to judge the age at which they believe their students are capable of understanding what exactly it is they are agreeing to and giving consent themselves. As such, depending on the context and the age of the student, it may be a case of involving both the parent/guardian and the student in the discussion about consent.
Photographing large groups
Getting consent to take and publish photographs of large groups of people can be challenging, for example what do you do if one or two individuals in the group do not give their consent? At a conference which the DPC attended recently, the organisers requested written consent from the speakers to being photographed at the event (and the photos published on the event website) and to being video-recorded while speaking on a panel at the conference because the intention was to later post the recording of the panel discussions on the organiser’s website. Based on whether each participant at the conference consented to these activities, they were given a different-coloured lanyard to wear around their neck, which signified to the photographer and videographer whether an individual had consented to being recorded or not. While this certainly took a lot of effort to organise, it was effective, and perhaps a similar approach could be used by schools in certain contexts. Take the scenario whereby a school wants to take and publish photos at a sports day – schools could inform parents in advance that photographs are going to be taken at this event and could provide different-coloured stickers for the children to wear to signify whether or not they can be photographed.
Is consent king?
Consent is not the only legal basis for processing personal data – and there may be instances where schools may be in a position to rely on legitimate interest as their legal basis for taking photographs. It’s important to note that where a school, or any other data controller, is relying on the legitimate interests legal basis, this requires a balancing exercise to make sure that the rights and interests of an individual, especially where the individual is a child, are taken into account and aren’t unfairly disregarded. For example where photos are being taken of school facilities for a school prospectus and a very large number of children collectively appear in the background of these various photos then it’s reasonable that the school should be able to publish such photographs for these purposes, relying on the legitimate interests legal basis – in other words without having to obtain consent in respect of each child whose image may have been distantly captured in the photo. But if such a photo captured only one or two children who were clearly identifiable in, say a playground setting, rather than a crowd scene with a large number of children in the same setting, then consent would be a more appropriate legal basis to publish the former photo, while it would seem reasonable for the school to rely on legitimate interests for the latter. In any event, schools like all data controllers, should be able to demonstrate their assessment of data protection issues and be able to point to why they have identified a particular legal basis as being most appropriate to a particular scenario where photos are being taken and published.
Some final thoughts…
We live in a world where every owner of a smartphone is a potential photographer. The GDPR does not provide an exact roadmap on when it’s permissible to take and publish photographs in the context of school events. However, a balanced, common sense approach will go a long way towards ensuring that individuals’ rights are respected, while also ensuring that data protection doesn’t become an obstacle to capturing and celebrating significant school events.
From: Data Protection Commissioner website