Andrew Laing, Head of Data Protection Complaints at the Information Commissioner’s Office (ICO) has issued schools with a stark warning on the importance of following data protection legislation. Mr Laing disclosed that the ICO has recently issued two schools with a reprimand for distributing photographs of pupils without parents’ consent, contrary to data protection legislation.
Despite this warning, Mr Laing has reassured schools that photographs of pupils, such as the traditional annual year photograph, do not need to be banned. Instead, schools need to be aware as to when data protection laws apply and provide staff training on this.
Essentially, data protection legislation will only apply when pupils’ parents have specifically requested photographs of their children not be used for purposes outside of the school, for example, being sent to the local newspaper.
To assist schools in navigating these rules, Mr Laing issued the following guidance:
- When photographs are taken for official school use, such as the school prospectus or the local newspaper, data protection legislation will apply and must be followed.
- Schools must ensure they have adequate procedures in place for handling images of pupils. They should not rely on one member of staff to check the parental permission spreadsheet.
- Any data breach must be reported to the school’s Data Protection Officer as soon as it happens, and consideration given as to whether it needs to be reported to the ICO.
- All staff should be educated on what personal data the school holds in respect of children, and regular training provided on this. To ensure schools can demonstrate data protection compliance, this should be recorded in writing.
