The EU General Data Protection Regulation
Working within a school and taking photographs for the school has necessitated considerable time and effort put into the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). On 25 May 2018 the current Data Protection Directive 1995 (Directive 95/46/EC) will be replaced by the GPDR meaning that the management of all information and data (including images) will change.
The GDPR aims primarily to give control back to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. The rights of privacy rights of individuals are protected more robustly, and there are three articles of the legislation that are of particular relevance:
- The right to be informed (articles 13 and 14) You must be clear about the context of how the photos are being used. For example you could not use photos for social media if permission had only been given for printed brochures.
- The right to access (article 15) Individuals have the right to access their personal data (photos) on request, and receive confirmation regarding how these are being used.
- The right to erasure (article 17) Individuals have the right to request photos be removed from websites, social media or future versions of printed materials.
If photos feature children under the age of 18, full written parental consent must be given.
For group shots the permission of parents / school may be sufficient. However elements that may identify an individual child such as a school badge should be avoided to ensure safety.
- ActNow.org.uk Using images of people: photographs, videos and webcams
- Campus PR Best practice guide to using photos
- e4education.co.uk How Will GDPR Affect Your School?
- GovernorsAgenda Data Protection law to be strengthened in 2018: Impact on Schools
- Boardman, R. (2016) Guide to the General Data Protection Regulation. London, Bird & Bird
- Information Commissioner’s Office Guide to the General Data Protection Regulation (GDPR)
- Wikipidia General Data Protection Regulation