Are schools permitted to cover a pupil’s face in a photograph if they have not given consent for the photograph to be used?
Schools need to assess whether a picture still contains a pupil’s personal data after covering or blanking out their face. Personal data is information that relates to an identified or identifiable individual – if it is possible to identify the individual, directly or indirectly, even with any identifiers removed or redacted, it may mean that the photograph is deemed as containing personal data.
If by covering a pupil’s face they can no longer be identified or is identifiable, the photo might not be considered their personal data. Schools need to assess whether covering a pupil’s face is enough to make them non-identifiable and this should be done on a case-by-case basis.
For further information about using a pupil’s photograph in line with GDPR, take a look at our ‘Are images of children considered to be personal data under the GDPR?’ article in the ‘Related content’ section on the right-hand side of this page. More information about what is deemed as personal data can be found on the ICO’s information page here.
ICO (2020) (Online conversation about whether schools can redact a pupil’s face in a photograph and use it without the need for consent) [Personal communication: 10 July 2020]
ICO (2018) ‘What is personal data?’, ‘At a glance’ <https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/> [Accessed: 10 July 2020]