As personal data, the use of photographs is governed by the GDPR. This guidance document contains advice from the DfE on how to process photographs under the GDPR, and collates answers to two photograph-related GDPR questions we’ve answered as part of our Need Further Help? service.
Appropriate use of photography
When determining whether to use photographs, you must take into account the intended use. In their guidance document ‘Data protection: a toolkit for schools’ the DfE guides that “photographs are used in school for many reasons” and that “the different uses should be considered separately and [each photograph will] potentially have different conditions for processing”.
Deciding whether legitimate interest is the most suitable lawful basis for processing photographs
To judge whether you can use legitimate interest as the basis for processing data, such as using pupils’ photographs as part of the school’s management information system, you should carry out three different tests, these are:
- A purpose test – establishing why you want to use the data, what will be achieved and whether the benefits are justifiable.
- A necessity test – establishing whether the processing of pupils’ data will be useful and whether there is a less intrusive way of reaching a means to an end.
- A balance test – establishing the impact it will have on the data subject by processing the data for said reason.
These three tests make up a ‘legitimate interest assessment’ (LIA) – you should carry out an LIA prior to obtaining the data and it should be recorded in a physical copy so that you are compliant with the GDPR.
An LIA is designed so that you can judge whether processing data in the ways you are suggesting is necessary and expected from the data subjects. The LIA is designed so that the data processors (the school) consider the impact the processing would have on the individual's own rights and freedoms.
Photographs used in identity management
These are likely to be essential for performing the public task of the school, but you should delete them once the child is no longer in attendance – as it is no longer needed for the purpose for which it was held.
Photographs in the school environment relating to education
These photographs may be essential for performing the public task of the school, but once the pupil has left the school this argument is not sufficient. If you wish to display the image beyond the pupil’s time at the school, you should seek their permission.
We were recently asked by a school leader: “In line with the GDPR, can schools display images of past pupils?”
Here’s what we advised:
Under the GDPR, schools are able to use pupil photographs as part of a display if they have a lawful basis for doing so, such as the individual’s consent; however, depending on the purpose of use consented to prior to the photograph being taken, the individual’s consent may need to be refreshed.
We spoke directly with the ICO, who clarified that “the consent gained at the time of the photo being taken will have been for a different purpose; therefore, in line with fair processing, the school would need to inform the individual of their plans to use the image and gain consent in relation to this new purpose”.
A simple method to effectively obtain consent is through the use of privacy notices with declarations attached. We created a GDPR Privacy Notice: Pupils and their Families and a Child-friendly GDPR Privacy Notice (which can be adapted to meet your school’s needs and utilised to gain consent from either the pupil themselves or from their parents). It is worth noting that until the age of 13, and in some cases 16 depending on the child’s maturity, parents are responsible for providing consent on their child’s behalf.
When gaining consent, including when initially taking the photograph or when the purpose of the image has changed, the pupil, or where appropriate their parents, must be informed of the retention period pertaining to the use of the image. If the image is still on display after the retention period stated in the privacy notice used to gain consent, the school will be in breach of their data protection obligations and may be subject to a fine.
You may wish to utilise our Record of Consent Log to ensure that consent for use of photographs is kept up-to-date and renewed as necessary.
Photographs used for marketing purposes
The DfE advises that you should seek specific informed consent for these images and only use them in line with the consent provided.
Learn more about GDPR and photography and take action with ease by using the following guidance, model policies and templates:
- Photography and Videos at School Policy
- Photography and Videos at School Leaflet for Parents
- Are images of children considered to be personal data under the GDPR?
- Images and Videos Parental Consent Form
- GDPR Privacy Notice: Pupils and their Families
- Child-friendly GDPR Privacy Notice
DfE (2018) ‘Data protection: a toolkit for schools’
 ICO (2018) (Email conversation regarding lawful basis for processing personal data) [Personal communication: 06 April 2018]
 ICO (2017) ‘Lawful basis for processing’, para.1 <https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/> [Accessed: 23 March 2018]
 ICO (2018) (Telephone conversation regarding the use of pupil photos) [Personal communication: 27 March 2018]