Data protection and school photographs

Schools issued with a stark warning on the importance of following data protection legislation.

Andrew Laing, Head of Data Protection Complaints at the Information Commissioner’s Office (ICO) has issued schools with a stark warning on the importance of following data protection legislation. Mr Laing disclosed that the ICO has recently issued two schools with a reprimand for distributing photographs of pupils without parents’ consent, contrary to data protection legislation.

Despite this warning, Mr Laing has reassured schools that photographs of pupils, such as the traditional annual year photograph, do not need to be banned. Instead, schools need to be aware as to when data protection laws apply and provide staff training on this.

Essentially, data protection legislation will only apply when pupils’ parents have specifically requested photographs of their children not be used for purposes outside of the school, for example, being sent to the local newspaper.

To assist schools in navigating these rules, Mr Laing issued the following guidance:

  • When photographs are taken for official school use, such as the school prospectus or the local newspaper, data protection legislation will apply and must be followed.
  • Schools must ensure they have adequate procedures in place for handling images of pupils. They should not rely on one member of staff to check the parental permission spreadsheet.
  • Any data breach must be reported to the school’s Data Protection Officer as soon as it happens, and consideration given as to whether it needs to be reported to the ICO.
  • All staff should be educated on what personal data the school holds in respect of children, and regular training provided on this. To ensure schools can demonstrate data protection compliance, this should be recorded in writing.

For more information, please visit Mr Laing’s blog here

CONTACT CHRIS

If you would like more information or advice relating to this article or an Employment law matter, please do not hesitate to contact Chris Cook on 01727 798089.

Read our latest views & insight about the GDPR
SA Law Red arrow neon light image
Views & Insights
Data protection and the coronavirus pandemic

Good news: The ICO provides clarity on common areas of data concerns during the unprecedented coronavirus pandemic.

Read More
SA Law Red arrow neon light image
Views & Insights
GDPR one year on: make sure your small business is compliant

Chris Cook shares vital tips for SMEs who haven't done anything to abide by GDPR, and how they can start going about compliance.

Read More
GDPR Numbers Image SA Law
Views & Insights
GDPR one year on

Subject access requests and complaints have been commonplace since the GDPR came into effect. Find out more about the trends and traps.

Read More
SA Law Red arrow neon light image
Views & Insights
What to expect in Data Protection Law in 2019

Our Data Protection Team highlight what we can expect to see from the Data Protection Act in 2019 and the potential impact of E-Privacy Regulations.

Read More
SA Law Red arrow neon light image
Views & Insights
Google issued with £44m fine over GDPR breach

Head of Employment and Data Protection, Chris Cook, explains Google's GDPR breach that led to landmark £44 million fine.

Read More
SA Law Red arrow neon light image
Views & Insights
What is the difference between a controller and processor under the Data Protection Act 2018?

Partner and Head of Employment & Data Protection, Chris Cook describes how to distinguish between a processor and controller under GDPR.

Read More
SA Law Red arrow neon light image
Views & Insights
GDPR - 6 Months On

Partner and Head of Employment & Data Protection Chris Cook comments on the impacts of GDPR over the past 6 months.

Read More
SA Law Red arrow neon light image
Views & Insights
ICO publishes passwords and encryption guidance

Partner, Chris Cook, identifies the new ICO guidance on passwords in online services and encryption under GDPR.

Read More

© SA LAW 2020

Every care is taken in the preparation of our articles. However, no responsibility can be accepted to any person who acts on the basis of information contained in them alone. You are recommended to obtain specific advice in respect of individual cases.